add simple auth checking
extracted 'edit post link' into its own view to make it cleanup whether it should be shown or not