More complete ACL permissions.

I finished the selector engine for ACLs. Now there are group, channel, and user based ACLs, and they can be mixed.

The ACLs work in a deny/allow fashion. If any rule denies the request, it is denied, no matter how many rules allow the request. This might make things tricky, but I don't think it will be a huge problem, because ACLs are *deny by default*. I want to see how people (want to) actually use this and then iterate.

r?