Enforce PUT-as-create permissions