Check study access rights and study exists

 Fix #445
I'm still not convinced about this... we might need in the future to import user form Study, and then we break everything... there isn't any better way of doing that check? I could have done a lot of other things in other places if I was able to import the objects, but I thought that we agreed on not doing that...

probably the answer is that we don't want to attach the access checks to the user object... what about attaching to the study? `study.has_access(user)` if the study is public it will return true, if not it can access to the tables in the same way... probably make more sense going this way...