Only show submission links if authorized to access them.

This wasn't a security hole, but it gave links that would not work.