Why only the parent address has the right to call flushTokens() for ERC20?

Once the parent address is set by the **init()** method
parentAddress of the Forwarder contract cannot be modified.

That means whoever calls the `flushTokens()` the ERC20 that Forwarder contract has
will be flushed to parentAddress.

Is there a reason related to security or logic, etc that only enables the **parent** to call
`flushTokens()`?