Security issue fix: https://security.drupal.org/node/65508 by Berdir, greggles: [D7] Access callback set to true - all users can edit permissions