Add permission check in create_email_flag_queue

Missing permission validation allowed unauthorized email flag creation.