Code review fixes ('has_core_access' as default permission to check).