I found a solution myself.
I check the permissions in the code behind:
if (!list.DoesUserHavePermissions(SPBasePermissions.ManageLists))
And I added this to the Elements.xml:
Rights="ManageLists"
Now the user isn't able to see the page unless he has the ManageList permission.
Maybe this will help somebody else later.
Thanks!