[MIE-1633] Validate create activities only for the current user

Add validation to allow POST to create activities only for the current user
You do not need to set up a fake server here. The `401` should come directly from the authentication policy before it even tries to contact an authentication endpoint.