Fix for STORE-352

Fixed by changing the permissions for the Published state transitions.

The private_user was given the +add,+delete+authorize access when switching to the Unpublished or Deprecated states.