Check reader permissions on RSS feed & sitemap

(on private instances)

Ref T576

routes.go

@@ -194,8 +194,8 @@ func RouteCollections(handler *Handler, r *mux.Router) {
 	r.HandleFunc("/tag:{tag}", handler.Web(handleViewCollectionTag, UserLevelReader))
 	r.HandleFunc("/tag:{tag}/feed/", handler.Web(ViewFeed, UserLevelReader))
 	r.HandleFunc("/tags/{tag}", handler.Web(handleViewCollectionTag, UserLevelReader))
-	r.HandleFunc("/sitemap.xml", handler.All(handleViewSitemap))
-	r.HandleFunc("/feed/", handler.All(ViewFeed))
+	r.HandleFunc("/sitemap.xml", handler.AllReader(handleViewSitemap))
+	r.HandleFunc("/feed/", handler.AllReader(ViewFeed))
 	r.HandleFunc("/{slug}", handler.CollectionPostOrStatic)
 	r.HandleFunc("/{slug}/edit", handler.Web(handleViewPad, UserLevelUser))
 	r.HandleFunc("/{slug}/edit/meta", handler.Web(handleViewMeta, UserLevelUser))