Fix to thumbs element, so it behaves sanely if the user doesn't have
access to use it, rather than calling the AJAX and silently failing, and
changing icons.  Will now just put up a defineable string in an alert if
someone clicks on a thumb, or just do nothing if no msg specified.