API Prevent DDOS by checking for env and admin on ?flush=1 (#1692)

2.4 version. See https://github.com/silverstripe/silverstripe-framework/issues/1692