Commit 565ab7a2e4 added a bypass to message subscription because some auto
subscription is done without the right to edit the record. However there
are two issues with this commit
* message_subscribe API changed and code tried to pass now removed parameters;
* sudo-ing without checking any access rights before is a security issue;
This commit fixes the call and add an access right on read. As few people
(mostly HR officers and managers) can read a leave request it solves the
issue of auto subscription while a better solution is found.
Thibault Delavallée
f86f8e488e