Disallow direct requests to the /{domain}/sys api
Disallow direct requests to the /{domain}/sys api

This is where our internal modules live, so unconditionally disallow direct
access from the outside. Additional unconditional ACL checks happen at the
path level (ex: per domain), as well as in each sys module. The main
contribution of this block is that it disallows direct access to some
resources where the user has *indirect* access to some resource when accessed
as part of another request.

physikerwelt/restbase,inverno/restbase,inverno/restbase,wikimedia/restbase,cscott/restbase,wikimedia/mediawiki-services-restbase,eevans/restbase,Krenair/restbase,d00rman/restbase,Krenair/restbase,cscott/restbase,wikimedia/hyperswitch,gwicke/restbase,wikimedia/restbase,milimetric/restbase,gwicke/restbase,physikerwelt/restbase,d00rman/restbase,wikimedia/mediawiki-services-restbase,Pchelolo/restbase,eevans/restbase,milimetric/restbase,Pchelolo/restbase