[Zope] Security (proxy role??)

Hi, I've got two questions. 1.Is Zope 2.2.0 masking the length of the passwords? 2. the more important-> I'm using a method to change properties by form. The user i.e. Tim has the role manager in the highest user_folder and acquisition is kept but Zope tells me that the user is not authorized. Why??? Thanks!