fixed: security issue: list acl not applied to all formats (raw/json etc), refractored menu item code into FabrikWorker::itemId()