'cms' module no longer sets permissions