Only show edit/admin buttons with appropriate permissions

This does not take into account superuser.  I'm not sure whether it
would be better to return different object permissions with superuser,
or to have a checkPermission-like function in js.