Site staff can always view, institution staff can view if
staffstats config option is set

Change-Id: Ia7dcd8623ef6d6eaba77a3370a1d9fb637163c29
Signed-off-by: Hugh Davenport <hugh@catalyst.net.nz>