restrict cost_price to admin users through the api

I imagine stores don't wish to share their cost price openly. This change limits cost price value to admin users through the api.
This becomes even more important if you configure the application to allow open access to the api, as it used to be in 2.0 and earlier. 
Agreed on the logic moving out of the view. I was just lazily following the existing pattern. It's a good call out. 
I'm actually more worried about your caching note. I think that would be an issue here.
I'll look at a cleaner mvc approach here and mess with the cache key to make sure data is accurate for all requests. 
Thanks for the feedback.