[#1421] Ensure that check_access is called on activity_create

Otherwise when disabling the activity streams the action returned before
calling the auth function, which made the auth audit fail