Adds two more before filters.

Again, this is for permissions and we need to cut off the api prefix in
every api/v? controller.
Removes timelines prefix in api/v2 controllers.

Some view expectation still features a timelines prefix. This is now
fixed.
Fixes redirect expectation in PE controller spec.

PE always returned 204 no content when updating via the API. Sending the
right format broke the expectation for a redirect.