[api] fix more borked active_rbac for use with :validate_params