Add email permission check on send_emails

Email send endpoints lacked permission checks, allowing unauthorized users to send emails.