Fix possible information disclosure within filter api

This fixes visibility of bugs within filter api for users who have
different roles in different projects.
I'm wondering if `REPORTER` shouldn't actually be `config_get( 'report_bug_threshold' )`