gateway: move all the authn/authz logic from api to action

[sgotti]

Currently there's a mix of authn/authz logic distributed between actions and api methods. We should move all this logic inside actions, while the api should only convert the request in an action request and convert the action response to the final response.