Fixes #17185: Read-only access via api should be available to VIEWER

There is no reason for the APIs to have a higher access level than the GUI. We can keep the configuration option but it should default the right behavior. I initially had it higher when the API was completely new.