repoListSubjectAllocations allows access to any users allocations

[dvstans]

This request includes a subject field that is not checked for permissions. Should restrict to only client and projects associated with the client.