In this RootController: http://bpaste.net/show/34255/ you see the UserController that gets dynamically dispatched using _lookup.
The statically mounted controller at /user asks for the manage Permission but the dynamically dispatched one does not.
I verified it happens the same way when you just inherit from RestController.
milestone: Undetermined --> 2.2.0
status: open --> closed
Fixed in crank 0.6 branch commit ba2b029c1cf3