Check study access rights and study exists

 Fix #445
The problem of that solution is that you're replicating some SQL code... I think is actually safer that the study checks if a user has access to it. Also, form my point of view, I think it makes more sense: "I, the study, grant you access to see anything about me if and only if you have access to me"