API for post message work whithout permission

Description:

All LDAP users can use the API and postMessage with all aliases and avatars. Same if the user has no permissions.

Steps to reproduce:

1. Take a ldap user with or without permissions
2. authenticate your user with the API
3. Use the API with your informations:
   curl -H "X-Auth-Token: 9HqLlyZOugoStsXCUfD_0YdwnNnunAJF8V47U3QHXSq"
   -H "X-User-Id: aobEdbYhXfu5hkeqG"
   -H "Content-type:application/json"
   http://localhost:3000/api/v1/chat.postMessage
   -d '{ "channel": "#general", "alias": "ANYBODY", "avatar": "ALLAVATARS", "text": "This is a test!" }'

Expected behavior:

An error because just user with role 'bot' can do it according to the documentation.

Actual behavior:

The message is send and the it's possible to anybody to usurp an identity

Server Setup Information:

• Version of Rocket.Chat Server: 3.2.2
• Operating System: Ubuntu server 18.04
• Deployment Method: Docker
• Number of Running Instances: 1
• MongoDB Version: 4.2

Client Setup Information

• Desktop App or Browser Version: API

Additional context