protect the "no ks" flag api action with api access control
add ALWAYS_ALLOWED_ACTIONS only when always_allowed_permission_names was not specified explicitly