fixes #1980: permissions follow role's inheritance