[Zope] strange behaviour of user.has_permission