[Zope3-Users] grant via zcml vs zmi

[John]

After working through Paul Carduner's z3c tutorial, I removed this zcml:

  <grantAll role="zope.Anonymous" />

and created two users that I thought should have equal permissions,
one called 'user' via this zcml:

  <principal id="zope.user"
             title="user"
             login="user"
             password_manager="Plain Text"
             password="user"
             />
  <grant permission="zope.ManageContent"
         principal="zope.user" />

and the other called 'user2', which I created in a PrincipalFolder under a
registered pau and granted the Manage Content permission, all via the zmi.

When I login as 'user' I am able to use an add form to add a contact.
But when I instead login as user2, I can see the add form but
cannot add a contact (instead zope prompts for a new login).  Why is this?

Thanks!