Fix a couple of bugs in the xtrn_area.sec[] and xtrn_area.prog[] arrays:

if the current user did not meet the access requirements, the corresponding
element if these associative arrays would be a random JS value, not the
actual program/section object.