fix(rest): enforce per-object API access on the cross-object batch route (#1604)

fix(rest): enforce per-object API access on the cross-object batch route (#1604) #9111