If a constraint has PermissionManager injected, instead we need to change it to accept Authority instead of User and remove PermissionManager dependency.
Calls to PermissionManager should be changed to corresponding calls to Authority.
Tests should be updated - no longer need to mock PermissionManager, but instead SimpleAuthority (with real UserIdentityValue, no need to mock it) with appropriate permissions should be passed.