<shiro:hasPermission> breaks action attribute of nested component

[fusiongyro]

I have this code in the UI:

<shiro:hasPermission name="course:delete:#{courseUI.course.id}">
  <h:form>
    <h:commandButton 
      value="Delete #{courseUI.shortCode}" 
      action="#{courseUI.delete}"/>
  </h:form>
</shiro:hasPermission>

When the button is rendered, clicking it causes a page reload, but nothing happens in the backend--my delete method is never invoked. Swapping the order of <h:form> and <shiro:hasPermission> has no effect on the problem.

Switching to this implementation does work, however:

<h:form>
  <h:commandButton 
    value="Delete #{courseUI.shortCode}" 
    action="#{courseUI.delete}"
    rendered="#{courseUI.canDelete}"/>
</h:form>

Going against this backend:

public String delete() {
  SecurityUtils.getSubject().checkPermission("course:delete:" + course.getId());
  user.removeCourse(course);
  return "pretty:home";
}

public boolean getCanDelete() {
  return SecurityUtils.getSubject().isPermitted("course:delete:" + course.getId());
}

So it suggests that the <shiro:hasPermission> tag is somehow interfering with the action method of the nested <h:commandButton>.