hide blank slate link if the user doesn't have 'create' permissions

fixes #2588