Legal page shows accept and delete form when not logged in

Summary

The "I accept the privacy policy" and "I want to delete my account" part is shown in the bottom of the legal page even if not logged in. It should only be visible when being logged in.

Steps to reproduce

Go to https://foodsharing.de/?page=legal and scroll down.

Relevant error messages and/or screenshots

Possible fixes

Add a $session->may() somewhere in the legal module.