Add AUDIT_WRITE cap

Fixes #6345

Thanks @larsks for outstanding investigation