List the models a provider offers for one of the machine's keys

The daemon calls the provider with the named key; only model ids come back.

A POST under the mutation policy although nothing is stored: the daemon sends the key to whatever host base_url names, so a cross-site GET riding the session cookie could have it sent to an attacker's host. CSRF, the write limit and standing apply as to a write. A daemon without the route (before 0.8.5) answers 404, which passes through: the console then asks for the model name instead.