enforces authorization for experimental api
removes no longer needed query menu items controller

This is now all handled via API.
remove unnecessary permissions
specs for json instead xml