[MIE-1633] Validate create activities only for the current user

Add validation to allow POST to create activities only for the current user
This is part of where the tests are wrong. You are relying on line 72 to send the 401 back if the IDs do not match. However the auth server has no idea if the IDs do not match. If the user IDs do not match Activity Streams needs to explicitly return an unauthorized or forbidden response (depending on how you view it).