Disabled project edits, results and updates are still accessable in myRSR through URL manipulation

[damienallen]

Buttons for edits, results and updates in myRSR/My Projects are sometimes disabled for projects depending on their status (eg. unpublished or complete). However, these pages can still be accessed directly by URL. Thus, access to the following pages should be restricted (raise 403 forbidden) accordingly under the same circumstances:

http://rsr.localdev.akvo.org/en/myrsr/project_editor/5/
http://rsr.localdev.akvo.org/en/myrsr/results/5/
http://rsr.localdev.akvo.org/en/project/5/add_update/

To clarify, the project id (in bold) can be changed to access project pages which should be disabled. Note, exceptions should be made for superuser where appropriate.

[damienallen]

Test plan

Try opening projects with 'completed' status, 'unpublished' status and with neither.

• Completed: project editor, results and add update should raise 403
• Unpublished: only results and add update should raise 403
• Otherwise: no error should be raised