getEditablePlaylist(playlistId: string,requestingUserId: string,canModerate: boolean): Playlist
Returns the playlist if requestingUserId may edit it. The cover upload
route checks this before it writes the file, then calls
setPlaylistImage.