list.php files are only invoked via ViewController and APIController

Both of them actually check that the user is logged in before
and also the list.php files themselves would break with
getUserSession()->getUser()->getUID() which they contain.

Signed-off-by: Joas Schilling <coding@schilljs.com>