added access check to callback

Only allow PREMIS viewing/access if the user has the 'view premis metadata' permission