Fix media API ACL check

Call is_allowed on the media model, not the whole collection. Typo!