remove collection updating authentication other than through api_admin_key
remove unversioned endpoints, /user endpoints in core, and non-admin privs for editing collections

passes all unittests
still needs functional testing with webapp.