check hpath existence *after* permission check