Fix permissions check for plugin endpoint.

Currently the permissions check looks at `manage_options` this capability does not have to do with plugin access.  The correct capability to check is `activate_plugins`. [For Reference](https://codex.wordpress.org/Roles_and_Capabilities#activate_plugins) and [source code reference](https://core.trac.wordpress.org/browser/trunk/src/wp-admin/plugins.php)
