[backend] make it possible to force publish a given repository
[api] validate that invalid users can not create requests

We still have a problem in webui session handling creating objects sometimes
as "noboby", after timeout. Almost all create/change operations fail due
to permissions, but not creating requests ...