Add permission check before displaying the image crop link.
Enforce permission check in the ajax call.