fix timecard rights checks

!== fails because active record uses strings and the auth system ints
fix timecard missing variable error
add bookingeditor error handling