HTMLClass.__getitem__ eventually instantiates a
HTMLProperty with nodeid set to ''. (We are looking
at a class, not an instance.)

HTMLProperty.is_view_ok() then will call
security.hasPermission(), which explicitely checks
for 'nodeid is None' before calling the user-provided
'check'.

It therefor seems as if the HTMLProperty should be
instantiated with nodeid set to None, not '',
or the security checking functions may blow up.