Check that the viewer can actually create badges before letting them create badges

Summary: Fixes T9467.

Test Plan: Set policy to "no one", got blocked.

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T9467

Differential Revision: https://secure.phabricator.com/D14159