Non-collaborators in Open space should not be able to edit/create boxes

[pirijan]

Open space users shouldn’t be able to make or edit boxes (allows abuse w no notifications).

implementation note: on server, update createboxes and updateboxes op auth checks.