Honour check_permissions at BAO level

API permission check can be skipped by setting $params['check_permissions'] to false. However, this only skips the check done by civicrm_api3_check_contact_dedupe() - checks done by BAO methods that happen to be called by the API will still enforce the permissions.

There isn't a simple way to fix this, as the permission skipping should probably be done at the CRM_Core_Permission_*::check() level; however, I can't think of a simple way to pass the $parms['check_permissions'] value there without heavy hacking of the codebase.