fixes #7989 - API v2 - support unwrapped parameters when doing POST/PUT to nested routes

added operating_id parameter to hosts and auth_source_id parameter to users in api/v2
```find_required_nested_object``` and ``````find_optional_required_nested_object``` share 4/5 lines, please DRY it up