Move access checks to their own method so they can be overridden, and
port an EE-only method to exist in CE too, with an EE-specific override.