FIX: Do not perform grants if badges are disabled

lib/guardian.rb

@@ -108,7 +108,10 @@ class Guardian
   alias :can_move_posts? :can_moderate?
   alias :can_see_flags? :can_moderate?
   alias :can_send_activation_email? :can_moderate?
-  alias :can_grant_badges? :can_moderate?
+
+  def can_grant_badges?(_user)
+    SiteSetting.enable_badges && is_staff?
+  end
 
   def can_see_group?(group)
     group.present? && (is_admin? || group.visible?)