Check study access rights and study exists

 Fix #445
Eh, I was trying to skip the overhead of instantiation and the DB calls, etc. associated with it. I can make it a part of the instantiated object if it's logically better.