Over in the dotLRN forum there was a thread in which the issue of not checking perms for certain file types was discussed. I think the consenus was to create a special directory which isn't checked (sometimes you want to check some, but not all, GIFs or JPEGs for perms, for instance).
Anyway I suggest you try to find that thread and maybe contact those who had opinions ...
I should also add my caching of permissions code stuff that I added for GP's version of the request processor.
