[webui] move finding the request into a before_filter

(to please code complexity check)
[api] forbid direct access to _project/_attribute?meta=1

This is the route the backend gets the API attributes from, but the user should
not be able to write it directly