Authenticated status tampering via missing permission checks

Missing authorization in SOPlanning before 1.55 allows remote authenticated users to add, edit, or delete any project status. The /status endpoint's Project Status handlers perform state-changing operations without checking whether the requesting account has permission to manage statuses. The gate is possession of any valid account, and the bounded consequence is unauthorized modification or deletion of project-status records.