[api] allow nobody to query everything he's not forbidden to do
[webui] test 'download logfile'