Refactor server API tests

[Azquelt]

Most of our server API tests are in ApiTest and PermissionsTest. There are a few reasons we shouls spend a little time refactoring them:

1. Since the work to ensure that non-logged in users cannot see unpublished assets the line between what should go in each test has become a bit blurred, meaning that it's harder to find where the test for a specific feature is located.
2. Both test classes have become quite large and may benefit from being broken up
3. The Permissions test is very exhaustive, running each test in 24 different combinations. This is probably overkill. We should run a small set of tests in this exhaustive form and run the rest in a smaller number of combinations.