Issue #2062031 by InternetDevels, rhm50: Replace user_access() calls with ->hasPermission() in tour module.