Index: main/waeup.sirp/trunk/src/waeup/sirp/applicants/browser.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/applicants/browser.py	(revision 7183)
+++ main/waeup.sirp/trunk/src/waeup/sirp/applicants/browser.py	(revision 7184)
@@ -234,13 +234,11 @@
         return self.context.access_code
 
-class ApplicantsTab(PrimaryNavTab):
+class ApplicantsAuthTab(PrimaryNavTab):
     """Applicants tab in primary navigation.
     """
-
     grok.context(IWAeUPObject)
     grok.order(3)
-    grok.require('waeup.Public')
+    grok.require('waeup.viewApplication')
     grok.template('primarynavtab')
-
     pnav = 3
     tab_title = u'Applicants'
@@ -249,4 +247,23 @@
     def link_target(self):
         return self.view.application_url('applicants')
+
+class ApplicantsAnonTab(ApplicantsAuthTab):
+    """Applicants tab in primary navigation.
+
+    Display tab only for anonymous. Authenticated users can call the
+    form from the user navigation bar.
+    """
+    grok.require('waeup.Anonymous')
+    tab_title = u'Application'
+
+    # Also zope.manager has role Anonymous.
+    # To avoid displaying this tab, uncomment the following.
+    #def tab_title(self):
+    #    userid = self.request.principal.id
+    #    if userid != 'zope.anybody':
+    #        tt = u''
+    #    else:
+    #        tt = u'Application'
+    #    return tt
 
 class ApplicantsContainerPage(WAeUPDisplayFormPage):
Index: main/waeup.sirp/trunk/src/waeup/sirp/applicants/permissions.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/applicants/permissions.py	(revision 7183)
+++ main/waeup.sirp/trunk/src/waeup/sirp/applicants/permissions.py	(revision 7184)
@@ -46,5 +46,5 @@
 class ApplicantRole(grok.Role):
     grok.name('waeup.Applicant')
-    grok.permissions('waeup.Public', 'waeup.View')
+    grok.permissions('waeup.viewAcademics')
 
 class ApplicationsOfficer(grok.Role):
Index: main/waeup.sirp/trunk/src/waeup/sirp/applicants/tests/test_browser.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/applicants/tests/test_browser.py	(revision 7183)
+++ main/waeup.sirp/trunk/src/waeup/sirp/applicants/tests/test_browser.py	(revision 7184)
@@ -138,4 +138,5 @@
             'Manage' in self.browser.contents)
 
+    
     def test_anonymous_no_actions(self):
         # Make sure anonymous users cannot access actions
@@ -173,22 +174,23 @@
         return
 
-    def test_local_roles_add_delete(self):
-        # Managers can assign and delete local roles of applicants root
-        myusers = self.app['users']
-        myusers.addUser('bob', 'bobssecret')
-        self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
-        self.browser.open(self.manage_root_path)
-        self.browser.getControl(name="user").value = ['bob']
-        self.browser.getControl(name="local_role").value = [
-            'waeup.ApplicationsOfficer']
-        self.browser.getControl("Add local role").click()
-        self.assertTrue('<td>bob</td>' in self.browser.contents)
-        # Remove the role assigned
-        ctrl = self.browser.getControl(name='role_id')
-        ctrl.getControl(value='bob|waeup.ApplicationsOfficer').selected = True
-        self.browser.getControl("Remove selected local roles").click()
-        self.assertTrue('Successfully removed:' in self.browser.contents)
-        self.assertFalse('<td>bob</td>' in self.browser.contents)
-        return
+    # We have no local roles yet
+    #def test_local_roles_add_delete(self):
+    #    # Managers can assign and delete local roles of applicants root
+    #    myusers = self.app['users']
+    #    myusers.addUser('bob', 'bobssecret')
+    #    self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
+    #    self.browser.open(self.manage_root_path)
+    #    self.browser.getControl(name="user").value = ['bob']
+    #    self.browser.getControl(name="local_role").value = [
+    #        'waeup.local.ApplicationsOfficer']
+    #    self.browser.getControl("Add local role").click()
+    #    self.assertTrue('<td>bob</td>' in self.browser.contents)
+    #    # Remove the role assigned
+    #    ctrl = self.browser.getControl(name='role_id')
+    #    ctrl.getControl(value='bob|waeup.ApplicationsOfficer').selected = True
+    #    self.browser.getControl("Remove selected local roles").click()
+    #    self.assertTrue('Successfully removed:' in self.browser.contents)
+    #    self.assertFalse('<td>bob</td>' in self.browser.contents)
+    #    return
 
     def test_add_delete_container(self):
@@ -423,21 +425,22 @@
         return
 
-    def test_local_roles_add_delete(self):
-        # Managers can assign and delete local roles of applicants containers
-        myusers = self.app['users']
-        myusers.addUser('bob', 'bobssecret')
-        self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
-        self.browser.open(self.manage_container_path)
-        self.browser.getControl(name="user").value = ['bob']
-        self.browser.getControl(name="local_role").value = [
-            'waeup.ApplicationsOfficer']
-        self.browser.getControl("Add local role").click()
-        self.assertTrue('<td>bob</td>' in self.browser.contents)
-        ctrl = self.browser.getControl(name='role_id')
-        ctrl.getControl(value='bob|waeup.ApplicationsOfficer').selected = True
-        self.browser.getControl("Remove selected local roles").click()
-        self.assertTrue('Successfully removed:' in self.browser.contents)
-        self.assertFalse('<td>bob</td>' in self.browser.contents)
-        return
+    # We have no local roles yet
+    #def test_local_roles_add_delete(self):
+    #    # Managers can assign and delete local roles of applicants containers
+    #    myusers = self.app['users']
+    #    myusers.addUser('bob', 'bobssecret')
+    #    self.browser.addHeader('Authorization', 'Basic mgr:mgrpw')
+    #    self.browser.open(self.manage_container_path)
+    #    self.browser.getControl(name="user").value = ['bob']
+    #    self.browser.getControl(name="local_role").value = [
+    #        'waeup.local.ApplicationsOfficer']
+    #    self.browser.getControl("Add local role").click()
+    #    self.assertTrue('<td>bob</td>' in self.browser.contents)
+    #    ctrl = self.browser.getControl(name='role_id')
+    #    ctrl.getControl(value='bob|waeup.ApplicationsOfficer').selected = True
+    #    self.browser.getControl("Remove selected local roles").click()
+    #    self.assertTrue('Successfully removed:' in self.browser.contents)
+    #    self.assertFalse('<td>bob</td>' in self.browser.contents)
+    #    return
 
 class LoginTest(FunctionalTestCase):
Index: main/waeup.sirp/trunk/src/waeup/sirp/browser/pages.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/browser/pages.py	(revision 7183)
+++ main/waeup.sirp/trunk/src/waeup/sirp/browser/pages.py	(revision 7184)
@@ -1128,5 +1128,5 @@
     """
     grok.context(IFacultyContainer)
-    grok.require('waeup.View')
+    grok.require('waeup.viewAcademics')
     grok.name('index')
     title = 'Academics'
@@ -1206,5 +1206,5 @@
     """
     grok.context(IFaculty)
-    grok.require('waeup.View')
+    grok.require('waeup.viewAcademics')
     grok.name('index')
     pnav = 1
@@ -1327,5 +1327,5 @@
     """
     grok.context(IDepartment)
-    grok.require('waeup.View')
+    grok.require('waeup.viewAcademics')
     grok.name('index')
     pnav = 1
@@ -1547,5 +1547,5 @@
     grok.context(ICourse)
     grok.name('index')
-    grok.require('waeup.View')
+    grok.require('waeup.viewAcademics')
     pnav = 1
     #form_fields = grok.AutoFields(ICourse)
@@ -1594,5 +1594,5 @@
     grok.context(ICertificate)
     grok.name('index')
-    grok.require('waeup.View')
+    grok.require('waeup.viewAcademics')
     pnav = 1
     form_fields = grok.AutoFields(ICertificate)
@@ -1702,5 +1702,5 @@
     grok.context(ICertificateCourse)
     grok.name('index')
-    grok.require('waeup.View')
+    grok.require('waeup.viewAcademics')
     pnav = 1
     #form_fields = grok.AutoFields(ICertificateCourse)
Index: main/waeup.sirp/trunk/src/waeup/sirp/browser/templates/studentsitelayout.pt
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/browser/templates/studentsitelayout.pt	(revision 7183)
+++ main/waeup.sirp/trunk/src/waeup/sirp/browser/templates/studentsitelayout.pt	(revision 7184)
@@ -29,9 +29,7 @@
             </span> </h1>
           <div id="navigation" class="yui-navset" style="text-align:right;">
-            <ul id="primary-navigation" tal:condition="layout/isAuthenticated">
+            <ul id="primary-navigation">
+              <tal:primary_nav content="structure provider:primary_nav" />
               <tal:primary_nav content="structure provider:primary_nav_student" />
-            </ul>
-            <ul id="primary-navigation" tal:condition="not: layout/isAuthenticated">
-              <tal:primary_nav content="structure provider:primary_nav" />
             </ul>
             <ul id="user-navigation">
Index: main/waeup.sirp/trunk/src/waeup/sirp/browser/viewlets.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/browser/viewlets.py	(revision 7183)
+++ main/waeup.sirp/trunk/src/waeup/sirp/browser/viewlets.py	(revision 7184)
@@ -551,5 +551,5 @@
     grok.viewletmanager(PrimaryNavManager)
     grok.order(1)
-    grok.require('waeup.View')
+    grok.require('waeup.Public')
 
     pnav = 0 # This is a kind of id of a tab. If some page provides
@@ -590,5 +590,5 @@
     """
     grok.order(2)
-    grok.require('waeup.View')
+    grok.require('waeup.viewAcademics')
     grok.template('primarynavtab')
 
@@ -603,28 +603,31 @@
 class ContactTab(PrimaryNavTab):
     """Contact tab in primary navigation.
+
+    Display tab only for anonymous. Authenticated users can call the
+    form from the user navigation bar.
     """
     grok.order(6)
     grok.require('waeup.Anonymous')
     grok.template('primarynavtab')
-    
+    tab_title = u'Enquiries'
     pnav = 2
-    def tab_title(self):
-        """Display tab only for anonymous. Authenticated users can call the 
-        form from the user navigation bar.
-        """
-        userid = self.request.principal.id
-        if userid != 'zope.anybody':
-            tt = u'' 
-        else:
-            tt = u'Enquiries'         
-        return tt 
-
-    @property
-    def active(self):
-        view_pnav = getattr(self.view, 'pnav', 0)
-        userid = self.request.principal.id
-        if view_pnav == self.pnav and userid == 'zope.anybody':
-            return 'active'
-        return ''
+
+    # Also zope.manager has role Anonymous.
+    # To avoid displaying this tab, uncomment the following.
+    #def tab_title(self):
+    #    userid = self.request.principal.id
+    #    if userid != 'zope.anybody':
+    #        tt = u''
+    #    else:
+    #        tt = u'Enquiries'
+    #    return tt
+
+    #@property
+    #def active(self):
+    #    view_pnav = getattr(self.view, 'pnav', 0)
+    #    userid = self.request.principal.id
+    #    if view_pnav == self.pnav and userid == 'zope.anybody':
+    #        return 'active'
+    #    return ''
 
     @property
@@ -717,5 +720,5 @@
     grok.viewletmanager(SubobjectLister)
     grok.context(IFacultyContainer)
-    grok.require('waeup.View')
+    grok.require('waeup.viewAcademics')
 
     def render(self):
@@ -728,5 +731,5 @@
     grok.viewletmanager(SubobjectLister)
     grok.context(IFaculty)
-    grok.require('waeup.View')
+    grok.require('waeup.viewAcademics')
 
     def render(self):
@@ -740,5 +743,5 @@
     grok.viewletmanager(SubobjectLister)
     grok.context(IFaculty)
-    grok.require('waeup.View')
+    grok.require('waeup.viewAcademics')
 
     def render(self):
Index: main/waeup.sirp/trunk/src/waeup/sirp/permissions.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/permissions.py	(revision 7183)
+++ main/waeup.sirp/trunk/src/waeup/sirp/permissions.py	(revision 7184)
@@ -23,6 +23,11 @@
     grok.name('waeup.Anonymous')
 
-class ViewPermission(grok.Permission):
-    grok.name('waeup.View')
+class Authenticated(grok.Permission):
+    """Only-logged-in-users-can-do-this-permission.
+    """
+    grok.name('waeup.Authenticated')
+
+class ViewAcademicsPermission(grok.Permission):
+    grok.name('waeup.viewAcademics')
 
 class ManageUniversity(grok.Permission):
@@ -50,5 +55,4 @@
     grok.permissions('waeup.manageUniversity')
 
-
 class ClearanceOfficer(grok.Role):
     """The clearance officer role is meant for the
@@ -74,5 +78,5 @@
     grok.name('waeup.PortalUser')
     grok.title(u'Portal User')
-    grok.permissions('waeup.View', 'waeup.Public')
+    grok.permissions('waeup.viewAcademics')
 
 class ACManager(grok.Role):
@@ -85,10 +89,10 @@
     grok.title(u'Portal Manager')
     grok.permissions('waeup.manageUniversity', 'waeup.manageUsers',
-                     'waeup.View', 'waeup.Public','waeup.manageACBatches',
+                     'waeup.viewAcademics', 'waeup.manageACBatches',
                      'waeup.manageDataCenter','waeup.managePortalSettings',
-                     'waeup.managePortalConfiguration',
-                     'waeup.manageApplications', 'waeup.handleApplication',
+                     'waeup.managePortalConfiguration', 'waeup.viewApplication',
+                     'waeup.manageApplication', 'waeup.handleApplication',
                      'waeup.viewStudent', 'waeup.manageStudent', 'clearStudent',
-                     'waeup.uploadStudentFile',
+                     'waeup.uploadStudentFile', 'waeup.viewStudents',
                      'waeup.viewHostels', 'waeup.manageHostels')
 
Index: main/waeup.sirp/trunk/src/waeup/sirp/students/browser.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/students/browser.py	(revision 7183)
+++ main/waeup.sirp/trunk/src/waeup/sirp/students/browser.py	(revision 7184)
@@ -33,5 +33,5 @@
 from waeup.sirp.browser.resources import datepicker, datatable, tabs
 from waeup.sirp.browser.viewlets import (
-    ManageActionButton, PrimaryNavTab, AddActionButton)
+    ManageActionButton, AddActionButton)
 from waeup.sirp.interfaces import (
     IWAeUPObject, IUserAccount, IExtFileStore, IPasswordValidator)
@@ -80,20 +80,4 @@
     return
 
-class StudentsTab(PrimaryNavTab):
-    """Students tab in primary navigation.
-    """
-
-    grok.context(IWAeUPObject)
-    grok.order(4)
-    grok.require('waeup.viewStudent')
-    grok.template('primarynavtab')
-
-    pnav = 4
-    tab_title = u'Students'
-
-    @property
-    def link_target(self):
-        return self.view.application_url('students')
-
 class StudentsBreadcrumb(Breadcrumb):
     """A breadcrumb for the students container.
@@ -170,5 +154,5 @@
     grok.context(IStudentsContainer)
     grok.name('index')
-    grok.require('waeup.viewStudent')
+    grok.require('waeup.viewStudents')
     grok.template('containerpage')
     label = 'Student Section'
Index: main/waeup.sirp/trunk/src/waeup/sirp/students/permissions.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/students/permissions.py	(revision 7183)
+++ main/waeup.sirp/trunk/src/waeup/sirp/students/permissions.py	(revision 7184)
@@ -27,4 +27,7 @@
     grok.name('waeup.viewStudent')
 
+class ViewStudents(grok.Permission):
+    grok.name('waeup.viewStudents')
+
 class PayStudent(grok.Permission):
     grok.name('waeup.payStudent')
@@ -48,15 +51,15 @@
     grok.permissions('waeup.handleStudent', 'waeup.uploadStudentFile',
                      'waeup.viewStudent', 'waeup.payStudent',
-                     'waeup.handleAccommodation')
+                     'waeup.handleAccommodation', 'waeup.Authenticated')
 
 # Site Roles
 class StudentRole(grok.Role):
     grok.name('waeup.Student')
-    grok.permissions('waeup.Public', 'waeup.View')
+    grok.permissions('waeup.viewAcademics')
 
 class StudentsOfficer(grok.Role):
     grok.name('waeup.StudentsOfficer')
     grok.title(u'Students Officer (view only)')
-    grok.permissions('waeup.viewStudent',)
+    grok.permissions('waeup.viewStudent','waeup.viewStudents')
 
 class StudentsManager(grok.Role):
@@ -65,5 +68,5 @@
     grok.permissions('waeup.viewStudent', 'waeup.manageStudent',
                      'waeup.payStudent', 'waeup.uploadStudentFile',
-                     'waeup.handleAccommodation')
+                     'waeup.handleAccommodation', 'waeup.viewStudents')
 
 class StudentsClearanceOfficer(grok.Role):
Index: main/waeup.sirp/trunk/src/waeup/sirp/students/viewlets.py
===================================================================
--- main/waeup.sirp/trunk/src/waeup/sirp/students/viewlets.py	(revision 7183)
+++ main/waeup.sirp/trunk/src/waeup/sirp/students/viewlets.py	(revision 7184)
@@ -7,4 +7,5 @@
 from waeup.sirp.utils.helpers import string_from_bytes, file_size
 from waeup.sirp.browser import DEFAULT_IMAGE_PATH
+from waeup.sirp.browser.viewlets import PrimaryNavTab
 from waeup.sirp.students.browser import (
     StudentClearanceDisplayFormPage, StudentClearanceManageFormPage,
@@ -139,4 +140,20 @@
     text = u'History'
 
+class StudentsTab(PrimaryNavTab):
+    """Students tab in primary navigation.
+    """
+
+    grok.context(IWAeUPObject)
+    grok.order(4)
+    grok.require('waeup.viewStudents')
+    grok.template('primarynavtab')
+
+    pnav = 4
+    tab_title = u'Students'
+
+    @property
+    def link_target(self):
+        return self.view.application_url('students')
+
 class PrimaryStudentNavManager(grok.ViewletManager):
     """Viewlet manager for the primary navigation tab.
@@ -151,5 +168,5 @@
     grok.template('primarynavtab')
     grok.order(1)
-    grok.require('waeup.View')
+    grok.require('waeup.Authenticated')
     pnav = 0 
     tab_title = u'Some Text'
@@ -166,23 +183,23 @@
         return ''
 
-class HomeTab(PrimaryStudentNavTab):
-    """Home-tab in primary navigation.
-    """
-    grok.order(1)
-    grok.require('waeup.Public')
-    pnav = 0
-    tab_title = u'Home'
-
-class ProspectusTab(PrimaryStudentNavTab):
-    """Faculties-tab in primary navigation.
-    """
-    grok.order(2)
-    grok.require('waeup.View')
-    pnav = 1
-    tab_title = u'Prospectus'
-
-    @property
-    def link_target(self):
-        return self.view.application_url('faculties')
+#class HomeTab(PrimaryStudentNavTab):
+#    """Home-tab in primary navigation.
+#    """
+#    grok.order(1)
+#    grok.require('waeup.Authenticated')
+#    pnav = 0
+#    tab_title = u'Home'
+
+#class ProspectusTab(PrimaryStudentNavTab):
+#    """Faculties-tab in primary navigation.
+#    """
+#    grok.order(2)
+#    grok.require('waeup.viewAcademics')
+#    pnav = 1
+#    tab_title = u'Prospectus'
+
+#    @property
+#    def link_target(self):
+#        return self.view.application_url('faculties')
 
 class MyDataTab(PrimaryStudentNavTab):
@@ -190,5 +207,5 @@
     """
     grok.order(3)
-    grok.require('waeup.Public')
+    grok.require('waeup.Authenticated')
     pnav = 4
     tab_title = u'My Data'
