The checkmark on
/_admin/permissions will seem to go back to the previous state after submitting.
It is something with caching in
User.get_by_username that retrieve outdated entities.
PermissionModel.update itself doesn't use caching, but before getting this far,
auth.py and others might have called
User.get_default_user(cache=True). Disabling cache in these other places make it work ... but at a cost.