Check Publisher after maintainer perms

The other order lead to the nasty surprise that whomever does the pending publish likely has permission to publish anything, there by allowing random people to republish other people's stuff, by proxy.