[MIE-1633] Validate create activities only for the current user

Add validation to allow POST to create activities only for the current user
Nico, where is this policy implemented? Is this in the API or on the database level? If it is in the database, I don't know if this test is really testing anything.