Fix membership access
We did not properly check that members belong to the correct study. This allows users who can edit/delete members in a single study to edit/delete members in other studies, e.g. granting them additional permissions in those studies. It does not allow these users to add new members to other studies.