enforce UI and Controller permissions when creating a Journal
Merge pull request #691 from Tahi-project/secure-journal-creation

Secure journal creation