How to restrict access to a path like user/%/flag?
You need to create custom Views access plugin for this.
First, you need to create mymodule.info file with next code

name = Mymodule
description = Custom code
core = 7.x
package = custom
dependencies[] = views
files[] = mymodule_access_plugin.inc


Second, add mymodule_access_plugin.inc in the your module folder  with next code

&lt;?php

/**
 * Access plugin that provides property based access control.
 */
class mymodule_access_plugin extends views_plugin_access {

  function summary_title() {
    return t('Custom access plugin');
  } // summary_title()

  /**
   * Determine if the current user has access or not.
   */
  function access($account) {    
    return mymodule_access($account);
  }

  function get_access_callback() {
    return array('mymodule_access', array());
  }

}


Third, implement  hook_views_plugins in your mymodule.module file

&lt;?php

/**
 * Implements hook_views_plugins()
 */
function mymodule_views_plugins() {
  $plugins = array(
    'access' =&gt; array(
      'test' =&gt; array(
        'title' =&gt; t('Custom access check'),
        'help' =&gt; t('This is a custom access plugin'),
        'handler' =&gt; 'mymodule_access_plugin',
        'path' =&gt; drupal_get_path('module', 'mymodule'),
      ),
    ),
  );
  return $plugins;
}

function mymodule_access($account = NULL) {
  global $user;
  if (!empty($account-&gt;uid) &amp;&amp; $account-&gt;uid == $user-&gt;uid) {
    return TRUE;
  }
  else {
    return FALSE;
  }
}


Fourth, clear caches and apply your custom access plugin in views