Add authorization to new branch/tag pages.

The create actions have authorization, the new actions didn't, so no-one unauthorized could actually do anything, but it was wrong(TM).