Make sure to check write perms after rewriting destination table

The write-permission check must occur after any destination-table
rewriting, otherwise any application would be able to write to
any global setting, by supplying a fraudulent "system" namespace
in the uri, but with a key name that will be redirected to global.

Bug 7289965

Change-Id: I122098a64e40d14e00d3cb6608c50aeb74faf7ce