fixes #10832 - separating lookup keys into puppet and variable

Fixes #11579 - Reports show/destroy restricted by host authorization (CVE-2015-5233)

ReportsController 'show' and 'destroy' now perform a check to see if
the User is authorized to see the Host associated with the Report. In
case it's not, it returns 404, as to not give hints whether a Report...

Fixes #4419 - rearranging smart class parameters edit form

Fixes #10248 - cloning volume information for virtual machines

Fixes #10550 - Settings API will not update when value parameter is missing

Fixes #11089 - Adapt tests to Rails 4

This commit contains all changes to tests in branch
https://github.com/theforeman/foreman/pull/2055 that I found to be
retrocompatible with Rails 3. The more of these we can get in, the less
code we will have to review for Rails 4, and the more relevant it will...

Fixes #8343 - Consolidated code paths, and removed unnecessary DB calls for parent object

Fixes #11078 - Substitute find_all_by by where to comply with Rails 4

This commit takes away all instances up to this point of find_all_by to
improve Rails 4 compatibility. They are substituted by .where calls.

Fixes #10356 - changed the POST/PUT RABL template to be the same as the GET template

HTTP response code standardized to 201 on create.

Fixes #10963 - partition table can't access os ids