auth: drop the internal "explicit" flag - the new default is all we want; explicit permissions should never blindly overrule indirect permissions

The "explicit" flag is already always false. Just hardcode it everywhere and
remove dead code.