[core] Doc model API and desktop permissions cleanup

Looks big but mostly URL rewrite
Move API to /desktop/api to unify and simplify permissions (as desktop
should always be non restricted, except at the view level. currently
non admin user can't log out :)
Improved testing of DocModel
Improved testing by switching to non admin user some tests
Add autocomplete to DESCRIBE statement in Beeswax