contact Dashboard permissions

Logically it would appear that the "access contact dashboard" drupal permission would be sufficient to enable contacts to view their dashboard. In fact they also need access civicrm, access civicrontibute, access civimail and profiles & listings permissions to view the dashboard - giving them much more access than they should have!