security.has_access() returns a predicate aka callable aka function. So has_access(...)() must be used. If you accidentally use has_access(...) in an "if" it'll be evaluated as true.
We could make has_access() return an object with a __call__
method (for predicate context) and a __nonzero__
method (for boolean context).
tv/2063
Looks good. Merged to dev.