Check study access rights and study exists

 Fix #445
Actually, you bring up a good point. Instead of using Study.get_public(), I can do a direct DB query since these are DB objects. Probably safer that way in the long run since nothing imports from anywhere.