[api] Add ssl_allowed to base_controller

Fixes #2665
Fixes #2696