after checking for bypass, ignore security manager only at the start of the call stack.

We want to ignore internal security manager calls when determining which was the last non-system caller,
but all such calls should be at the end of the call stack. If the security manager appears further up,
then something is wrong and we should not ignore it.
add guest pass permission class

TODO Develop a custom security manager that will recognise guest pass permissions