Code in SiteSettingsHandler doesn't go through the (relatively newer) permissions layer (PermissionsManager). Currently there is new code being introduced in SiteSettingsHandler that will do this, but this only affects the "Site Details" backend (see  Issue 656758 ). The whole of Site Settings should be refactored to do the same, but this should be done after "Site Details v0" is launched.