"Actions" links on entity browsing screens not tested for access

Problem/Motivation

There are no access checks applied to e.g. "edit" and "delete" links presented on entity overview screens. Since these screens are potentially accessible to users without edit or delete permissions, inappropriate links are visible. (This is not a security issue, as following these links produces an access denied page.)

Proposed resolution

The following code from node_admin_nodes() is a good model:

    // Build a list of all the accessible operations for the current node.
    $operations = array();
    if (node_access('update', $node)) {
      $operations['edit'] = array(
        'title' => t('edit'),
        'href' => 'node/' . $node->nid . '/edit',
        'query' => $destination,
      );
    }
    if (node_access('delete', $node)) {
      $operations['delete'] = array(
        'title' => t('delete'),
        'href' => 'node/' . $node->nid . '/delete',
        'query' => $destination,
      );
    }

However, currently these links are generated in theme functions like theme_redhen_contact_list(). Before adding more logic at the theming level, it would be good to refactor and pull the existing logic out of theme functions.