include content restriction in default JCR query