When looking at an App's root page, I should not see the "create" buttons

Summary: Eric points out that, if he navigates up to "System", even as Anonymous, he sees the "Design a New Model" button. So we're not checking permissions correctly in general, and specifically failing to realize that this never makes sense when looking at an App.