remove no longer required experimental controller
enforces authorization for experimental api
removes no longer needed query menu items controller

This is now all handled via API.
remove unnecessary permissions
specs for json instead xml
Merge pull request #1902 from opf/fix/experimental_api_missing_authorizations

Fix/experimental api missing authorizations