rest: add policy to list all resource

This limits the scope of resource listing to the authenticated
user/project and allows to retrieve all the resources using a special
policy.

Change-Id: I58644e17ba7a9bf32ca9ae246ff1ccac3b7ee906