"Proper" access controls on adding a master block require changing
addmaster.shtml to addmaster.html, then removing the SSI segments.
The HTML fragment left is then loaded and printed via main.cgi in
a new action section "addmaster", which can be per-user-ACL-wrapped.