API authentication now respect application wide login_required setting

The permission for accessing user resource is pretty simple for now: Depending on the application setting (login_required) we either allow access to everyone, or only to logged in users. 
This PR also takes care of bug, when it was not possible to access public project's work packages for anonymous user (https://www.openproject.org/work_packages/13689)
Better to include tests before we merge this.