fixes #6331 - use view permission to authorize individual VM show pages