BUG: module_system | admin batchactions -> the default batchactions validate the permissions, at least at module-level