fixes 2330 adds api controllers and actions to access_permissions.rb