MGP - no permissions for grading period without feature flag on

fixes CNVS-15968

test plan:
 * using the API
 * with the Multiple Grading Periods flag off
 - try to create/read/update/delete a grading period
 > it should return a 'not found' error

Change-Id: I92ed920fde7f03c4ac9a051d4a7212bf43a53fa3
Reviewed-on: https://gerrit.instructure.com/44552
Reviewed-by: Josh Simpson <jsimpson@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Amber Taniuchi <amber@instructure.com>
Product-Review: Cameron Sutter <csutter@instructure.com>

app/controllers/filters/grading_periods.rb

@@ -1,7 +1,11 @@
 module Filters::GradingPeriods
   def check_feature_flag
     unless multiple_grading_periods?
-      render status: 404, template: "shared/errors/404_message"
+      if api_request?
+        render json: {message: t('Page not found')}, status: :not_found
+      else
+        render status: 404, template: "shared/errors/404_message"
+      end
     end
   end
 end

app/models/grading_period_group.rb

@@ -9,6 +9,7 @@ class GradingPeriodGroup < ActiveRecord::Base
     can :read
 
     given do |user, http_session|
+      return false unless (course || account).root_account.feature_enabled?(:multiple_grading_periods)
       if course
         course.grants_right?(user, http_session, :update)
       elsif account