add api for allowed actions for user

another commit

remove allowed_actions.py

add import pdb at two places

remove pdb

working first pass

make the controller call GET and not post, also use viewbuilder