use user_access (not role check) in private files form #1505

9b320867