Update handling of permissions for update/renew

[PaulMorris]

While working on PR #967 we deferred some work on the underlying code. The UI doesn't expose certain operations, like updating or renewing applications that are not in approved status, but the underlying code should also not allow these operations (as before PR #967), and that is currently not the case. See discussion on zulip starting here.