Load SecurityComponent by default for API requests

It's better to have it on by default and users manually switch certain
features off. Further, it will have minimal impact on existing code, ie:
we do not need to add checks for presence of SecurityComponent.
Nodes: Implement /api/nodes/lookup and autocomplete for Node.parent_id

Closes #461
Merge branch '2.0-nodes-api' into 2.0