require :manage_grades to Re-Upload Submissions

test plan:
 - as a teacher, go to an assignment that has submissions
   and click "Download Submissions" on the right side
 - in another tab, log out
 - return to the first tab and click "Re-Upload Submissions"
   and select the file you just downloaded
 - click the Upload button, and you should be taken to a
   login prompt

fixes CNVS-29342

Change-Id: Ia9c592b7d5d631e8f4ce8778547593bc5d97c7e9
Reviewed-on: https://gerrit.instructure.com/79527
Reviewed-by: Cody Cutrer <cody@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
Tested-by: Jenkins
QA-Review: KC Naegle <knaegle@instructure.com>
Product-Review: Keith T. Garner <kgarner@instructure.com>

app/controllers/gradebooks_controller.rb

@@ -485,6 +485,7 @@ def submissions_json
   end
 
   def submissions_zip_upload
+    return unless authorized_action(@context, @current_user, :manage_grades)
     unless @context.allows_gradebook_uploads?
       flash[:error] = t('errors.not_allowed', "This course does not allow score uploads.")
       redirect_to named_context_url(@context, :context_assignment_url, @assignment.id)

spec/controllers/gradebooks_controller_spec.rb

@@ -519,6 +519,15 @@ def check_grades_page(due_at)
     end
   end
 
+  describe "POST 'submissions_zip_upload'" do
+    it "requires authentication" do
+      course
+      assignment_model
+      post 'submissions_zip_upload', :course_id => @course.id, :assignment_id => @assignment.id, :submissions_zip => 'dummy'
+      assert_unauthorized
+    end
+  end
+
   describe "POST 'update_submission'" do
     it "allows adding comments for submission" do
       user_session(@teacher)