rest-api: change Allow header to reflect the client's permissions on the...

... resource

Signed-off-by: Gregory Meno <gmeno@redhat.com>

@dmick @kmkanagaraj @tserong