Let the studio portal's calls through block_endpoints

On sites with `block_endpoints`, signed-out visitors to `/help` were sent to login and ticket pages returned a 404. The portal's calls now pass through, and each new method checks permission itself.