Bug 22216: Make GET /patrons/{patron_id} staff only