[api] allow to accept reviews for delete requests

wrote a test case to highlight issue #550 and fix it with yet another
attack of the spaghetti code monster
[api] refactor the whole changestate permission check

This whole logic if a request can change state is worth an extra file, it's
almost 300 lines of code
[api] split the changestate check

the various action types require different checks so they can also have
different functions