[webui] Turn around condition in AttribPolicy#create?

Since we fallback to the container permission check anyway, we can also
test this first and only do the other permission checks if needed.