[webui] make sure to check if source access is allowed in #show
[api] fix db:setup in a sane way