fixes #3010 - use the correct helper function name
fixes #2860 - don't convert arbitrary input into symbols (CVE-2013-4180)
fixes #2863 - restrict APIs to resources that a user is permitted to manage (CVE-2013-4182)
Fixes #2414 - Move puppet report processing code to the report processor

This creates a API route for POST:/api/reports which matches the GET
format for reports. Tests are updated, with the report model tests
moving to the puppet-foreman module (along with the report fixtures).