Check write permission in whitelisted document methods

`run_doc_method` was only checking read permission; writes via `db_set`, `db_update`, and direct SQL were accessible to any read-permitted user.