restrict cost_price to admin users through the api

I imagine stores don't wish to share their cost price openly. This change limits cost price value to admin users through the api.
This becomes even more important if you configure the application to allow open access to the api, as it used to be in 2.0 and earlier.