Fix/experimental api missing authorizations

https://www.openproject.org/work_packages/15710
Why XML instead of JSON? I assume XML support will be removed at some point, e.g. when creating a proper API v3 for this.