Document user access requirements for REST API

Added user access information for Abilities API.

Author: gziolo

docs/5.rest-api.md

@@ -2,6 +2,10 @@
 
 The WordPress Abilities API provides REST endpoints that allow external systems to discover and execute abilities via HTTP requests.
 
+## User access
+
+Access to all Abilities REST API endpoints requires an authenticated user (see the [Authentication](#authentication) section). Access to execute individual Abilities is restricted based on the `permission_callback()` of the Ability.
+
 ## Schema
 
 The Abilities API endpoints are available under the `/wp/v2/abilities` namespace.