API Security - Competitions and Participants

[ihsaan-ullah]

@ mention of reviewers

@Didayolo

A brief description of the purpose of the changes contained in this PR.

This PR solves 2 issues:

1. In http://localhost/api/competitions/ , emails of users were leaked.
2. In http://localhost/api/participants/ , no participants will be shown unless this is accessed from the website and not from /api/participants

Competition users emails:

Tested:

• users emails are not leaked
• participants are now shown in /api/participants
• approve and revoke functionality works
• sending email to participants works

Issues this PR resolves

• leak users #885

Checklist

• Code review by me
• Hand tested by me
• I'm proud of my work
• Code review by reviewer
• Hand tested by reviewer
• CircleCi tests are passing
• Ready to merge