1. delete hottier should be restricted for internal streams
2. POST /logstream/{logstream} should be restricted for query mode

1. update role sync between querier to ingestors
2. get user role priviledge to reader, writer and editor roles

… using /ingest API

current state: check stream name in resource path for authorization
fix: check the x-p-stream header for the stream name also