should not be a string, use permission='string' for that. The behavior
for iterating over all elements of a string is of course to create lots of
single-letter permissions.

This fixes Collector issue 22, from runyaga