Fix permission check on new usage stats endpoint

api/custom/usage.go

@@ -223,7 +223,7 @@ func GetUsersUsageStats(r *http.Request, rctx rcontext.RequestContext, user api.
 	serverName := params["serverName"]
 
 	isGlobalAdmin, isLocalAdmin := api.GetRequestUserAdminStatus(r, rctx, user)
-	if !isGlobalAdmin || !isLocalAdmin || (isLocalAdmin && r.Host != serverName) {
+	if !isGlobalAdmin && (serverName != r.Host || !isLocalAdmin) {
 		return api.AuthFailed()
 	}