acl: Support checking write permissions on a prefix