page.dashboard.inc: check for host permissions