Prevent users from editing under another identity

Later entries in a hash constructor overwrite earlier entries for the
same key. Together with WS::js::Edit's deficient input validation,
this makes it possible to overwrite the editor_id and privileges
arguments when creating edits. Consequently, any registered user can
enter edits of the types supported by WS::js::Edit under some other
editor's name and with elevated privileges (autoeditor).

Although WS::js::Edit should absolutely be equipped with whitelists of
allowable fields per edit type to tighten conceivable further security
holes, the least invasive fix, applied in this commit, for the main
issue described above is to invert the order of arguments in the call
to MB::S::Data::Edit::create.
Merge remote-tracking branch 'chirlu/impostor_fix'

* chirlu/impostor_fix:
  Prevent users from editing under another identity