follow-up to reports permissions patch

follow-up to reports permissions patch

* Enforce the requirement that the user must have the
  create_reports permission in order to delete a saved report;
  closes hole where unprivileged user could delete reports
  by constructing a URL maliciously
* Added another tweak of the template - don't offer option
  to create a new report if the user doesn't have permission.

Signed-off-by: Galen Charlton <gmcharlt@gmail.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>