added join workspace button if policy allows self joining

I also don't really see an end user changing the request from a post to a get that often. This is not regular use of the site. If they somehow do manage to do this, the Forbidden exception is fine in my opinion.