Ensure Limitations can be set for Sync (and general) writes

[enobrev]

Currently the API allows anyone to write anything. Generally this can be controlled by the overriding project, but for Sync posts, there is no checking for access from the overriding project