Subscriber-level booking note creation via missing authorization

Missing authorization in Metagauss EventPrime 4.2.0.0 and earlier allows remote authenticated users to add notes to any booking. The booking_add_notes AJAX handler accepts a supplied booking identifier and note, then calls the booking controller after nonce validation without checking an administrative capability. A Subscriber account and a valid booking nonce are sufficient; the bounded consequence is unauthorized text written into any booking's administrative notes.