We used to think adding this method to the top level is enough
and could avoid misuses. But it turns out we still need them in
other permission backend classes so that we only need to rescope
a user when necessary, which could provide better performance.
See I67b72b59 as an example.
Change-Id: I9ef30fb38315250fa63fb8b3d27e19e19d5e3e22
2b2a99e538