Here's a temporary fix, given the potential hassle described in private
email (mail me or roundup-devel and I'll reply with details).

We could either ditch EditCSVAction entirely or add permission checks to
it, if it's an useful action.

To solve this class of problems, I think it'd be necessary to add
another kind of permission ('EditCSV') to Roles and check for that.