188 enforce user type

This adds in authorization checks to InnerView and AdvisorProfileView
I think we should make a `PermissionDeniedView` that's a little more descriptive than just the header.