"manager" URLs not blocked for content that doesn't belong to you

[TrueBrain]

If after login I for example visit:

https://bananas.staging.openttd.org/manager/newgrf/66724456

It acts like I can edit this package, while I really cannot. When I press save, the API will block the request and not processed it, but it does look weird from a user perspective.

Guess we should check for permissions when visiting those pages, and show an error instead of an edit page.

[James103]

I can reproduce this as of the time of writing (1. log in, 2. follow the link above).