fixes #2248 adds api controllers and actions to access_permissions.rb