Enforce permissions on js validation/save