fix a bug with flask-rbac