fix: unify permission across account events.

don't ignore exported security warning; account added is protected by permission now, it should not be possible to call it without proper permission