EZP-21315: fixed: use SecurityContext to check access