fixes #7989 - API v2 - support unwrapped parameters when doing POST/PUT to nested routes

added operating_id parameter to hosts and auth_source_id parameter to users in api/v2
No need to ```find_nested_object``` twice, probably just a typo.