vps: use has_permission() in templates