api refactor: force access control and handle subpaths

Signed-off-by: Vladimir Mandic <mandic00@live.com>

javascript/extraNetworks.js

@@ -294,7 +294,7 @@ function selectHistory(id) {
   const headers = new Headers();
   headers.set('Content-Type', 'application/json');
   const init = { method: 'POST', body: { name: id }, headers };
-  fetch('/sdapi/v1/history', { method: 'POST', body: JSON.stringify({ name: id }), headers });
+  fetch(`${window.api}/history`, { method: 'POST', body: JSON.stringify({ name: id }), headers });
 }
 
 let enDirty = false;