Hide moderation for non-moderators. Close #240.

Also test this to try and prevent it from sneaking in again.

app/views/submissions/_submission_listgriditem.html.erb

@@ -13,7 +13,7 @@
         <% end -%>
       </p>
 
-      <% unless submission.content.is_expired? %>
+      <% if can?(:update, submission) && !submission.content.is_expired? %>
       <p>
         <%= link_to t(:moderate), "#", :class => "btn small dropdown-control dd-moderate", :title => t(:moderate_title, :name => submission.content.name), :rel => "#moderate_#{ submission.id }" %>
       </p>

test/functional/submissions_controller_test.rb

@@ -12,4 +12,16 @@ def setup
     assert_redirected_to feed_submissions_path(feeds(:boring_announcements))
   end
 
+  test "show feed does not have moderation" do
+    get :index, :feed_id => feeds(:service).id
+    assert_select ".dd-moderate", 0
+    assert_select "button", 0
+  end
+
+  test "feed moderator sees moderation" do
+    sign_in users(:katie)
+    get :index, :feed_id => feeds(:service).id
+    assert_select ".dd-moderate", feeds(:service).submissions.active.count
+  end
+
 end