client api: accessing sthpw search types using non admin user

[Diego]

Hi LazyLeopard,
this is bad security bug!

I tracked it to src/pyasm/search/search.py
When api_mode is open (default) there is no check for access to some security critical tables

Could you open an Issue on github reporting the bug? I will make a PR to fix it...