Fixed various checks for permissions, to not rely on sm:has-access(),
which checks for the current user, who is not always the intended user.