Fixes for reviewer access controls.
Permission checking didn't include logic for 'review assigned model'
and an SQL query for looking up the assigned reviewer hadn't been
updated during the last big code update.