improved permission checks

... by using existing TiddlyWeb infrastructure