Check system manager permission for take backup APIs

Adds a System Manager check to the take_backup APIs, which any authenticated user could previously call.