[COM-1101] - update to include check that user is allowed to see flag…

…s through the api

src/Api/Controller/ListFlagsController.php

@@ -40,6 +40,7 @@ protected function data(ServerRequestInterface $request, Document $document)
         $actor = $request->getAttribute('actor');
 
         $actor->assertRegistered();
+        $actor->assertCan('viewFlags');
 
         $actor->read_flags_at = time();
         $actor->save();