`ajax_reassign_seat` has no capability check, reachable by anonymous users

Seat reassignment runs with no permission check and is reachable by anonymous users.

Seater.php:132