Restrict verify to pushmaster and user

Verify should only be available to those in the know - namely the user who created the pull request and the pushmaster.

No known existing tests for templates yet. Verified in test instance by playing around with the database and changing users for the pushmaster and the request owner.