[api] allow nobody to query everything he's not forbidden to do
[webui] test 'download logfile'
[api] fix some issues reported by brakeman

and use escape_utils, see benchmarks on https://github.com/brianmario/escape_utils
[api] update gem versions