New permission plone.restapi.UseRESTAPI should exclude @login

[sneridagh]

The permission is now enforced internally as:

https://github.com/plone/plone.restapi/blob/master/src/plone/restapi/services/__init__.py#L24

But the thing is that the @login endpoint should be able to access by anonymous always. The tests should have been assuming some user logged in the first place, as they are not failing...

Maybe other endpoints should bypass this permission. I would personally only use the zcml permission instead of hardcoding it but... it's my 5 cents.

[sneridagh]

@buchi @lukasgraf @tisto Any thoughts?

[buchi]

@sneridagh Absolutely! The login endpoint must be accessible without the UseRESTAPI permission.
I've prepared PR #167 to fix this.

If other endpoints need to bypass the permission, they can override the check_permission() method. It's not possible to have another permission in ZCML.