Moved all ACL stuff to `authorization controller`. Gutter app-controller, and fixed logger.