fscrypto: require write access to mount to set encryption policy