Check study access rights and study exists

 Fix #445
maybe. it's a little ambiguous, because I would personally put this in the user object as `user.has_study_access(study_id)`. Actually, I think I'll do it that way, since it also removes some object use in qiita_pet.