Quick question --
Does the ADMIN restriction apply to classes extending QueryModule as well as those found via reflection?
I didn't see the permissions checks when poking around the relevant code, and am thus not quite sure where they are -- but to me, it would make sense to have QueryModule methods be responsible for running their own permission checks (as they're written for explicit use with BaseX), while continuing to require ADMIN for anything found via reflection. [This assumes that ADMIN, as opposed to WRITE, is needed to install such modules... I think there were changes in that regard recently?]