[core] Doc model API and desktop permissions cleanup

Looks big but mostly URL rewrite
Move API to /desktop/api to unify and simplify permissions (as desktop
should always be non restricted, except at the view level. currently
non admin user can't log out :)
Improved testing of DocModel
Improcded testing by switching to non admin user some tests
Add autocomplete to DESCRIBE statement in Beeswax
Merge remote-tracking branch 'remotes/origin/testing' into testing