permission checking on node tags factorized in Node.caller_may_write_tag