abort with 403 if item is locked and user is not admin, fixes #59

this prevents disclosure of metadata of locked items.