readd experimental controllers and add authorization to them

Controllers where removed in https://github.com/opf/openproject/commit/f91256fef9b9ccd40219901454c13bec9f0776c6 as they where deemed to no longer be in use. A mistake...

* https://www.openproject.org/work_packages/15892