`ContentEditController::createWithoutDraftAction()`, added in EZP-25100, does not check if the user has permission to create this content type in that location / language.

Given that HTTP cache is per role, it can be checked without impacting HTTP caching.