add authz check to manifest sign *before* offering secret question

[pkarman]

trello: https://trello.com/c/LGkCxslV/333-only-allow-users-with-the-proper-cdx-roles-to-sign-a-manifest