SECURITY: don't grant same privileges to user_api and api access

User API is no longer gets bypasses that standard API gets.
Only bypasses are CSRF and XHR requirements.

lib/current_user.rb

@@ -26,6 +26,10 @@ module CurrentUser
     current_user_provider.is_api?
   end
 
+  def is_user_api?
+    current_user_provider.is_user_api?
+  end
+
   def current_user
     current_user_provider.current_user
   end