Fix/experimental api missing authorizations

https://www.openproject.org/work_packages/15710
Why are both calls only made when the controller this is included to responds to both methods? Accidentally not disabling access to non-API actions seems dangerous.

I'd like a code comment here.