[SECURITY] permission mapping ineffective (was: [Zope] ZClass and Permissions)