fixes #5612 - use correct permissions for authz in parameters API

Two changes here - one is a change to the common parameters controllers to match the UI controller, so it authorises with the correct permission.

The second changes the API controller from using permissions like "view_domains_parameters" instead of "view_domains" when viewing parameters *of that domain*.  I can't see any permissions that rely on this two-part naming convention...