188 enforce user type

This adds in authorization checks to InnerView and AdvisorProfileView
This is okay for now. In the future, I think it would be cool for `PermissionDeniedView` to compose both `InnerView` and `OuterView`, and render whichever one was appropriate, with the same message.