Load SecurityComponent by default for API requests

It's better to have it on by default and users manually switch certain
features off. Further, it will have minimal impact on existing code, ie:
we do not need to add checks for presence of SecurityComponent.
Nodes: Implement /api/nodes/lookup and autocomplete for Node.parent_id

Closes #461
Merge branch '2.0-nodes-api' into 2.0
Include admin.css which theme authors can override
Add publish_[start|end] input elements to Node, Link and Menu

To take advantage of this feature, either supply your own custom
admin theme or use AdminExtras.

Closes #455
Merge branch '2.0-timepicker' into 2.0