From #187540

After discussions with the security team, the public API shouldn't check the capabilities api. Instead, we should rely on the saved objects api to error when a request is made with insufficient privileges.

While removing the code is simple enough, we should verify that behavior is largely unchanged.

Currently, the spaces api impacts REST api calls. This was never the intention for the spaces api. A superuser should be able to modify data views even if 'data views' are disabled in a given space.