/updates/refresh should check authZ

[iliana]

We're likely to keep /updates/refresh long-term (to provide, say, a [🔄 Check for updates] button in the console), but this should be behind authZ because repeatedly refreshing can potentially (but hopefully shouldn't) interfere with updates working.

(From #717)

[davepacheco]

See also: #419

[iliana]

This was done in #790