unauthenticated users should not see the edition buttons

The backend enforces that a user is Login and has Authorization to edit a resource. The frontend omitted to enforce the user is Login. This was a issue on a resource without user field, an imported resource for instance.