API call whitelist

Problem/Motivation

For security reasons it would be good if administrators were able to limit which api calls client can make.

Here is a list: https://etherpad.org/doc/v1.8.4/#index_api_methods