add explicit authorization for POST on edit pages

Logged in users could see edit pages, but submitting would fail because POST goes to a different request. These are now explicitly authorized to be called by logged in users. Even if one later changes the authorizations for editing, it is better to state these ecplicitly.

Fixes #37