fix permission for event undo

managers can undo restocks. this should have been included with the
previous change concerning fixing manager permissions.

chezbetty/views_admin.py

@@ -3406,13 +3406,13 @@ def admin_event_receipt(request):
 
 
 @view_config(route_name='admin_event_undo',
-             permission='admin')
+             permission='manage')
 def admin_event_undo(request):
     try:
         # Lookup the transaction that the user wants to undo
         event = Event.from_id(request.matchdict['event_id'])
 
-        # Mangers can only see restocks.
+        # Mangers can only undo restocks.
         if event.type != 'restock' and not request.has_permission('admin'):
             raise Exception('Not authorized to undo this event.')