Discourse: Any authenticated user can download full list of users, including email

The ExportCsvController allows users to export different types of entities, if one has guardian access: https://github.com/discourse/discourse/blob/master/app/controllers/exportcsvcontroller.rbL6 However, the guardian check only checks that the entity type is not "admin":...