add missing access checks for viewing a bug