Check study access rights and study exists

 Fix #445
If we want to attach the access checks to the user object, we're going to have to import stuff into the user object. If we only go one way (into the user) we should be ok.