Fix #16 Manager can bypass content access permission