Permissions are not considered on resources contained within the requested resource

[bencap]

For instance, if a user requests an experiment set to which they have access the API only considers permissions on the experiment set, not for contained experiments within it. This is true of experiment -> score set relationship as well (although it is less of an issue, since generally speaking the same users who have view access on experiments will have it on contained score sets).