Add extra security check to Echo API to prevent vandalism

1. Only trigger mark as read if the unread notification count is > 0
1. Add a limit to the number of notification that can be marked as read
2. Only update those records with read_timestamp = null

Change-Id: I12456c504787f45f594ef9283e98d98692956935
Merge "Add extra security check to Echo API to prevent vandalism"