Merge branch 'new-tag-branch-authorization' into 'master'

Add authorization to new branch/tag pages.

The create actions have authorization, the new actions didn't,
so no-one unauthorized could actually do anything, but it was wrong(TM).

See merge request !1979