bug fixing - bugs detected by manually poking around on the site

need additional testing suite to systematically go through all
permissions
need additional permissions check at Model level - models.py

rowers/rower_rules.py

@@ -193,15 +193,15 @@ def can_add_session(user):
 def can_plan(user):
     return user.rower.rowerplan in ['plan','coach','freecoach']
 
-# checks if rower is coach of user
+# checks if rower is coach of user (or is user himself)
 @rules.predicate
 def is_coach_user(usercoach,userrower):
-    if not is_coach(usercoach):
-        return False
-
     if usercoach == userrower:
         return True
 
+    if not is_coach(usercoach):
+        return False
+
     r = userrower.rower
 
     coaches = []