[api] Override require_login in SourceController

The SourceController uses models that require a proper login even on GET.
One example is getting the sources of a package with osc if source access
is disabled.

Signed-off-by: Jan Blunck <jblunck@infradead.org>