[#369] updating packages to deleted state had permission issues

This causes the v1/2 REST package update API to fail with access denied
because after successfully updating the package, the user no longer has
permission to read it to generate the dict-like response.

Just allow us to read the updated packeage