Added the security tag around the add External References button so it
appears only when the user has the necessary permissions. Previously, an
unauthorised user could click on it but the servlet would throw an
AccessDeniedException.