Ensure clients of /api/issue can only push badges they issued themselves.