added static 403, study vote/show auth checks open/owner