Check study access rights and study exists

 Fix #445
But then you are replicating the SQL for getting shared and private studies for a user. Really either way, it's replicating code.