Restricting the receipt API to authenticated users (bug 917601)

Otherwise a 500 will be raised given the usage of `request.amo_user`