Modified package-show authorization logic (custom state, no organization)

yes, you are right, i thought that this object was always loaded.
so, i suppose the condition should be changed to:

```
user_obj and (getattr(user_obj, 'id', None) == package.creator_user_id)
```

I have updated our branch accordingly.