Security fix for unprivileged access to attendance records

In the current code if a student can gain access to the attendance record of any other student on a course by adding

studentid=<a valid id>

to the URL for viewing the attendance activity. This patch ensures that only users with permissions to modify the activity can see other user's attendance records.