Fix permission check in /htmlbox