Fix missing permission check in the "add type" view.

The permissions were checked in the next step,
so this didn't cause a security issue.