Check study access rights and study exists

 Fix #445
good point @adamrp 
@squirrelo you should be requiring the User object, not the id; it will be more robust