[gollem] Problem with Gollem permissions

[Shaun B]

I can't seem to get the permissions to enforce in Gollem. As long as a user
can see a file, he/she seems to be able to delete it. Privacy isn't our
primary concern with file storage; we don't mind if a user can see another
user's file, we just don't want them to be able to delete their files. I've
tried with both file and sql backends. Below is the horde.perms datatree,
the backend.php files that I used for both files and sql (seperately, of
course). The show and read permissions are working just fine (when a user
has neither of these, he can't see the file manager or the files
respectively). What am I doing wrong? Version of Horde is
3.1.1 Gollem is H3 1.0.2. PHP is 5.0.5.

datatree:
horde.perms => gollem => Array ( [type] => matrix [users] => Array ( [user1]
=> 6 [user2] => 14 [user3]  => 30) ) Array ( )

backends.php (for file vfs)
$backends['file'] = array(
    'name' => 'Shared Files',
    'driver' => 'file',
    'preferred' => '',
    'hordeauth' => false,
    'params' => array('vfsroot' => '/data/tmp/homedirs/'),
    'loginparams' => array(),
    'root' => '/',
    'home' => '/',
    // 'createhome' => false,
    // 'permissions' => $conf['umask'],
    // 'filter' => '^regex$',
    // 'quota' => false,
    'clipboard' => true,
    'attributes' => array('type', 'name', 'download', 'modified', 'size')
);

backends.php (for sql.php)
$backends['sqlhome'] = array(
    'name' => 'Shared Files',
    'driver' => 'sql',
    'preferred' => '',
    'hordeauth' => false,

    // The default connection details are pulled from the Horde-wide SQL
    // connection configuration.
    'params' => array_merge($GLOBALS['conf']['sql'], array('table' =>
'horde_vfs')),
    'loginparams' => array(),
    'root' => '/',
    'home' => '/' . Auth::getAuth(),
    'createhome' => true,
    // 'filter' => '^regex$',
    // 'quota' => false,
    'clipboard' => false,
    'attributes' => array('type', 'name', 'download', 'modified', 'size'),
);