Workflow manager has permission denied when in api_mode = "closed"

[remkonoteboom]

Describe the bug
The workflow manager doesn't work in api_mode = "closed". This is because of numerous server.eval() calls. These eval calls should either be moved to commands or there should be a special api command key that allows for restricted eval calls.

To Reproduce
Steps to reproduce the behavior:

1. Set security/api_code in config file to closed
2. Go to Workflow Manager

Expected behavior
No permission denied errors.