Check study access rights and study exists

 Fix #445
That's not an appropriate use of 400. Lets use 418... I think 404 would actually be the best here as the resource described doesn't exist