page.users.inc: check for host permissions