[feature/api] Updated controllers to use the new auth function

Instead for checking for each point in each controller function
(api enabled, user has permission etc) each controller now calls the
auth function in the api auth class that decides if the user has access
to what he tries to do and returns the users user_id if success or an
error message on failure.

PHPBB3-11595
[feature/api] Cleaned up auth test

Removed unused parameter userid.

PHPBB3-11595