fixed security check for subtypes

Fix (security): Attribute access to schema fields can be protected. This worked for direct schemas, but was not implemented for permissions coming from behaviors.