Move the post_password check into `check_context_permission()`