In invite admin, hide buttons the user isn't allow to use.

On the token administration page, all controls are always displayed, even if the current user has read-only rights.
The use of those controls is checked server-side but nothing is done to hide those buttons from the user.
This patch attemps to solve this problem.

Steps to reproduce:
- log-in as admin
- create a user with read-only rights
- create an invite-only survey
- generate some tokens
- log-in as the read-only user
- goto token management
- you'll see buttons like "delete" that you won't be able to use, because rights will be checked by the server-side code

Before:

![token_admin_controls](https://f.cloud.github.com/assets/3476089/1279807/10cd6e2c-2f41-11e3-8dba-a0d1bc70b6c4.png)

After:

![perm_read_only](https://f.cloud.github.com/assets/3476089/1279838/23cb518c-2f42-11e3-8e79-f2895ab6e0e0.png)