Instead of ANAND's suggestion to put this function in the `player` API,
I feel it belongs in the `boxes` API instead, other than that it's
mostly similar to his MR#18.
This moves the perk code so it can handle offline players
easily. Granted perks are immediate if the player is online
and otherwise granted at login. This avoids any of the issues
with offline players.
