API activity/create should retain existing source contact

When using the activity/create API with an ID to update an existing activity, the original source contact should be retained. Currently, in all cases, the logged-in contact is set as the source, potentially overwriting the original source contact. This patch checks for an existing source and adds that to the params, only resetting the source contact if there's no existing activity id or (for whatever reason) if the activity has no source contact.