permission. This isn't a security hole, since they can't actually add
stuff.. but they can try and fail which is a bad user experience.
Also fix it up so that we show the option menu only if there's stuff
to show, and cache some of the permissions for performance (which I'm
guessing at-- didn't benchmark it).