FOUR-28520 Fix code review observations.

Author: gproly

routes/api.php

@@ -60,8 +60,10 @@
     Route::delete('users/{user}', [UserController::class, 'destroy'])->name('users.destroy')->middleware('can:delete-users');
     Route::put('password/change', [ChangePasswordController::class, 'update'])->name('password.update');
     Route::put('users/update_language', [UserController::class, 'updateLanguage'])->name('users.updateLanguage');
-    Route::get('users_task_count', [UserController::class, 'getUsersTaskCount'])->name('users.users_task_count');
-    Route::post('users_task_count', [UserController::class, 'getUsersTaskCount'])->name('users.users_task_count_post');
+    Route::get('users_task_count', [UserController::class, 'getUsersTaskCount'])->name('users.users_task_count')
+        ->middleware('can:view-users');
+    Route::post('users_task_count', [UserController::class, 'getUsersTaskCount'])->name('users.users_task_count_post')
+        ->middleware('can:view-users');
 
     // User Groups
     Route::put('users/{user}/groups', [UserController::class, 'updateGroups'])->name('users.groups.update')->middleware('can:edit-users');