[BUG] No verification that only organizer can create/open/close rollcall

[arnauds5]

Description (Actual behavior)

On the be1-go backend, there is no verification that only organizer can create/open/close a rollcall.
Anyone can send theses messages (using a modified frontend) and the go backend will accept them.

Expected behavior

There should have a verification of the public key and deny any rollcall create/open/close if not from an organizer.

How to reproduce

1. Create a Lao with client1 (organizer)
2. Join the Lao with client2 (with a modified frontend that allow sending the messages)
3. Create/open/close a Rollcall with client2
4. See no error (expected to fail)

Version & Environment

This bug was reproduced on:

• Commit: 8f30905

Front-ends:

• Fe1-Web (please include browser's names & version)
• Fe2-Android (please specify if phone or emulation, and Android version)
• Not applicable

Back-ends:

• Be1-Go
• Be2-Scala
• Not applicable

Environment (as applicable):

Workaround

The scala backend doesn't seem to be vulnerable to the same problem.

Impact

Anyone can maliciously create a new rollcall and add many PoP token.

Possible root cause

No verification that the sender of a rollcall create/open/close is the organizer.