Make permissions for AJAX dashboard backend match

If you don’t have permission to see the HTML dashboard, you shouldn’t be
able to see the JSON one.

app/main/views/dashboard.py

@@ -57,6 +57,7 @@ def service_dashboard(service_id):
 
 @main.route("/services/<service_id>/dashboard.json")
 @login_required
+@user_has_permissions('view_activity', admin_override=True)
 def service_dashboard_updates(service_id):
     return jsonify(**{
         'today': render_template(