Adjusts security restrictions for vacation rest api

* Rest api operations that are used in the web frontend of the
  application must be reachable by users without extended
  privileges.

* refs #16792
Release version 1.5.2
Prepare for next development iteration