Update permissions for API routes

Necessary to fix the core routes tests, eg http://ci.theforeman.org/job/test_plugin_foreman_discovery/47/

@lzap how does it look to you?
no *multiple* actions