[426] Fix for API permission checks.

The problem was two-fold, first was that the dgu_package_create path for
the rest call received the correct data, but unnecessarily wrapped it in
a list.  Second problem was that two of the tests (unrelated to the first
error) assumed that nhsadmin could not work with sub-publishers.