Here is a good place for the permission check. Something like:

```php
if (JFactory::getApplication()->isAdmin() || JFactory::getUser()->authorise('core.manage', 'com_modules'))
{
    JLayoutHelper::render('joomla.edit.frontediting_modules', array('moduleHtml' => &$moduleHtml, 'module' => $mod, 'position' => $position));
}
```