Permission fix

Before we had groups, I did a fast hack for “is staff” on reviews, to
avoid information leaks from review panes.  Updated for correct
permission set for each review type so users don’t have to be staff to
be reviewers.  (Vendors and Proposals was already OK, fixed the others.)