REST: add write access checks to BasicAccess