Check for permissions on PUT for review request resources.

We were relying on open/close to check proper permissions when executing
close/reopen, but we'd ideally want to check before going that far. Now
we execute checks in the update handler so we catch things early.

Unit tests pass.