[api] move the actual auto accept out of the clock daemon

The clock daemon stops while doing jobs, so everything that takes
longer than a couple of milliseconds should only trigger a delayed
job

While I was at it, I moved the rather huge and clumpsy BsRequest.collection
function into a model on its own (to be further refactored)