Fix two issues with api scopes and admin permissions to api backends:

1. If an api backend had multiple url prefixes, a limited admin account
   couldn't access the backend even if the admin was granted access to
   all the individual prefixes involved. admin account belonged to
   multiple. This is now fixed so that as long as your admin account has
   access to *all* the url prefixes involved in a backend, then you can
   access the backend.
2. Any admin could access an API Backend that had no URL prefixes
   defined on it. An API Backend without prefixes isn't actually valid
   or functional, so not a huge deal, but it led to some confusing
   results, since in some cases, that backend would not be visible, and
   then other times it would show up.