Use 'manage_options' as the permission check for /api route

[mlwilkerson]

Our ConfigController has a permissions check for:

current_user_can( 'manage_options' )

But the API Controller has:

current_user_can( 'edit_posts' )

We should use the same in both places, probably changing the latter to use manage_options