API Require ADMIN for ?showtemplate=1 (2.4)

Doesn't expose sensitive data (to my knowledge), but still an information leak, so low-priority security issue. 
Also raised a PR for 3.0 with https://github.com/silverstripe/sapphire/pull/1182