Stick to AccessControl directly for checking buyable controls permissions. <SpecialUser 'Anonymous User'> instance returned by plone.api.user.get_current() not provides checkPermission function, which makes it useless.