use p.a.portlets.ManagePortlets permission instead of cmf.ManagePortal