fixes #7989 - API v2 - support unwrapped parameters when doing POST/PUT to nested routes

added operating_id parameter to hosts and auth_source_id parameter to users in api/v2
DRYed it up. Thanks.