Check that user has permission to access campaign in Go API

Currently any user who can login to the Go API can access any campaign id. This is a giant security hole.