Don't allow review of storage requests that were not submitted

[mzur]

The storage request controller shows only requests that were not approved yet but it does not hide requests that were not submitted. Requests that were not submitted should not be shown by the controller. Fix this and add an appropriate test case.

[mzur]

The tests are here. It also includes an example for a 404 response when the storage request was already reviewed. The same should be expected for a storage request that was not submitted.