I added new permissions in rev5879:94a7669677ae they are:

  Rest Access
  Xmlrpc Access

to cgi/client.py.

Adding entries to schema.py like:

  db.security.addPermissionToRole('User', 'Rest Access')
  db.security.addPermissionToRole('User', 'Xmlrpc Access')

will permit the User role to use the xmlrpc and rest APIs.

Looking at handle_xmlrpc, it looks like error conditions
were not properly reported. I made some changes that seem to work,
but it could use another set of eyes.