Compute permissions per-user before broadcasting so users without VIEW_CHANNEL never receive the channel_created event.