capabilities fix

added check for capabilities inside metabox_init() and
save_post_images()