Hide some workflow buttons from users without update privileges

https://reciprocitylabs.atlassian.net/browse/CORE-10
https://reciprocitylabs.atlassian.net/browse/CORE-11
It means use the context of the referenced object rather than specifying it separately.