XPages: +Page button visible despite 'viewer' user

A readonly user, with these userroles:

• xm.cms.user - Required to login and use the CMS application
• xm.channel.viewer - Allows viewing channels through role channel-viewer; implies xm.webfiles.reader
• xm.content.viewer - Allows viewing content through role readonly

can open the Experience Manager and see preview channels.

Expected: blue +Page button is not visible/enabled

Actual: blue +Page button is visible and enabled, user can try to create an XPage (which fails later on).

Easily reproducible on https://cms.demo.onehippo.com