Minimizing URI permission lookup in `data.set()` if PATCH is allowed