change api permissions

- api.host is only visible for configured IPs
- GET to urls matching "*/data" is allowed for everyone.
- PUT,POST,DELETE to /data is only allowed for configured IPs