#214390 by shrop. Partial backport of #153998, use a separate permission for blogapi since it does not depend on blog module.
