Fix broken template management permissions logic

Old logic effectively denied access if a user was not an admin *or* was
not a CheckUser

New logic is correct behavior, deny access if a user is not an admin *and*
is not a CheckUser