Permissionfix

Fixes some permissions on getting list of submissions.
I think you can replace this with `Submission.submitter.IN(group.members)`. Although I'm not sure totally.