fixed logical mistake in giving access rights to creating etc

[noerten]

in previous version:

if not request.user.is_staff or not request.user.is_superuser: raise Http404

one could get access only if he is an admin. if he is a staff then this part comes to live: if not request.user.is_superuser: raise 404 Coz he isn't admin, then 404