Add ACL's to users api

Add and access control layer to user's api. This way it would be easy to detect by the system that current user is allowed/not allowed in particular url.