fix an access control bug