Check study access rights and study exists

 Fix #445
a cleaner way to do this is
```python
return self._id in user.private_studies + user.shared_studies + self.get_public()
```
but this way works, so this should not be blocking