->permission() sanitizing: pass MAY_NOT_BLOCK to ->check_acl()