Refactor api_call_* filters

[gravitystorm]

Most controllers have the same set of around_action filters, e.g.

around_action :api_call_handle_error, :api_call_timeout

However, some don't:

• api/users_controller: around_action :api_call_handle_error - I think the lack of timeout is an oversight?
• api/user_preferences_controller: around_action :api_call_handle_error - again, I think this is an oversight?
• api/changesets_controller: around_action :api_call_handle_error; around_action :api_call_timeout, :except => [:upload] - I can see a logic for removing the timeout for the upload, since it could be quite big (n.b. rails not used in production for this)
• api/traces_controller: around_action :api_call_handle_error - I think adding the timeout handling here would be fine, but maybe exempt :create to align with changesets#upload ?

I would like to refactor the controllers, similar to #4859 so that these handlers are applied by default, and exceptions are used (e.g. skip_around_action only where necessary.

[gravitystorm]

I tried this today, and one complication was related to the order of the adding the api_call_handle_error and authorizing the action - moving the handler into api_controller meant that api_call_handle_error grabbed the CanCanCan exception itself.

[AntonKhorev]

Some controllers (traces?) have different error handlers for different actions. One action may support xml error responses, other may not.