Two-level page permissions fixes