text_chat permission is not enforced server-side

With text_chat disabled, it is still possible for non-owners and anonymous users to post chat messages via the ret channel e.g. `APP.hubChannel.channel.push("message",{type:"chat",body:"can still chat"})`