FIX Prevent DOS by checking for env and admin on ?flush=1 (#1692)

Ensure that flush=1 only causes an actual flush if one of the following is true

- You are in dev mode
- You are logged in as an admin
- An error occurred while attempted to start up the page

Currently it's not very elegant when in live mode & not yet logged in - it just silently ignores the flush=1 variable, instead of requesting login details

Slightly different approach to Ingo's patch (#2237, #2238) - this doesn't modify Core.php, and so should cause fewer regressions. 

Fixes #1692, will need versions for 2.4 & 3.1