API response declares images as valid:true incorrectly

Take an image, for example a no-rights image such as:

77aec23e43f3c98c7a845bd2b6e8574a79933469

The api response in the browser for a user with no metadata editing privileges (not necessarily important, I haven't tested yet as a metadata editor) correctly flags the image as invalid

`https://api.media.gutools.co.uk/images/77aec23e43f3c98c7a845bd2b6e8574a79933469
`

```
valid: false,
invalidReasons: {
paid_image: "Paid imagery requires a lease",
no_rights: "No rights to use this image"
},
cost: "pay",
```

however the same image declares itself as valid when the API is queried with an API key, so for example:

`curl --header "X-Gu-Media-Key:apikeyinhere" https://api.media.gutools.co.uk/images/77aec23e43f3c98c7a845bd2b6e8574a79933469
`

returns

```
"valid":true,
"invalidReasons":{
"paid_image":"Paid imagery requires a lease",
"no_rights":"No rights to use this image"
},
"cost":"pay",
```

This leads to InDesign users being able to access paid images for print without the picture desk granting them a lease. The API accessed with an API key should return validity based on the access levels of a non Picture desk user. So pay for images should only be valid if there is an active allow lease applied.