Added ACL support, with a separate permission required for the ability to delete a badge, and enforced this permission on the backend.