Create a new "add" permission and require it at the controller level

when adding photos/movies/albums

modules/server_add/helpers/server_add_task.php

@@ -32,6 +32,7 @@ class server_add_task_Core {
         $file = $context["files"][$path][$context["position"]];
         $parent = ORM::factory("item", $file["parent_id"]);
         access::required("server_add", $parent);
+        access::required("add", $parent);
         if (!$parent->is_album()) {
           throw new Exception("@todo BAD_ALBUM");
         }