"Add some resources" link shown to unauthorized users

Also the stand-alone new resource page (`/dataset/new_resource/dataset_id`) shows to unauthorized users