Access checks

Move access control primarily to bp_group_extension display(). Don't
show users who can't do the survey any form fields in the analysis
section. Make allowances for whitelisting specific users
(super_secret_access-- also can't do the survey, but can see the
analysis).