Split machine urls into user/admin parts.

Some user templates try to display links to machines. Let them, but
don't give full admin access.

Change-Id: I57062d6adc5576ef3d59bce88654beb06e1eed60