you're right though, I can change the code to check the permission first and then load the node via the key.
The fact that `getNodeByIdentifier` doesn't check ACLs is another bug, showing just how many holes we have around ACLs unfortunately.