webaccess: Check for read-only pad ID in `userCanModify`
webaccess: Check for read-only pad ID in `userCanModify`

This currently isn't absolutely necessary because all current callers
of `userCanModify` already check for a read-only pad ID themselves.
However:

  * This adds defense in depth.
  * This makes it possible to simply replace the import handler's
    `allowAnyoneToImport` check with a call to `userCanModify`.

ether/etherpad-lite,storytouch/etherpad-lite,storytouch/etherpad-lite,ether/etherpad-lite,ether/etherpad-lite,storytouch/etherpad-lite