box: fix accidental exposure of _collation space to public

'public' role and thus guest and any newly created user has 'write'
privilege to _collation space. It is not enough to modify _collation as
one also needs 'create' privilege to add a collation and 'drop privilege
to delete one. So it is safe. Yet looks like we don't have any purpuse
of exposing _collation now.

NO_DOC=bugfix