Enforce permissions on get device api endpoint

Any logged in user could read any device.

src/controllers/api/device.go

@@ -554,6 +554,7 @@ func (d *Device) EditExpirationHandler(w http.ResponseWriter, r *http.Request, p
}

func (d *Device) GetDeviceHandler(w http.ResponseWriter, r *http.Request, p httprouter.Params) {
	sessionUser := models.GetUserFromContext(r)
	macParam := p.ByName("mac")

	mac, err := net.ParseMAC(macParam)
@@ -568,6 +569,11 @@ func (d *Device) GetDeviceHandler(w http.ResponseWriter, r *http.Request, p http
		return
	}

	if device.Username != sessionUser.Username && !sessionUser.Can(models.ViewDevices) {
		common.NewAPIResponse("Unauthorized", nil).WriteResponse(w, http.StatusUnauthorized)
		return
	}

	if device.ID == 0 {
		w.WriteHeader(http.StatusNotFound)
		return