Move karaage.legacy references from urls

Also fix missing permission checks.

karaage.legacy.list_detail no longer used, removed.

Change-Id: Ic128f8d476e0651e9126f8ce36596f4f821bdbdd