Permission-check logs, sends without a reference, and account sync endpoints

Whitelisted endpoints for logs, sends and syncs required no permission check, so any logged-in user could read business logs, send from the business number, or trigger a sync; now each requires matching DocType permission.