Check study access rights and study exists

 Fix #445
since the study is a `QiitaStatusObject`, can you use the setter for the `status` property here rather than calling the SQL directly?  Magic numbers have a way of causing problems down the line