Check authorization on endpoints

[diegoalzate]

overview

with all recent updates from v2.5.0 and v2.5.1 it is important to not allow users to do things they should not be allowed to do.

examples

• get a secret code from the api
• leave a group impersonating another user
• any impersonation should be double checked
• get vote score from api [can be seen in cycles]