Move ACL APIs from server to plugin. Server can have its own APIs for
standalone use (compared to integration with CloudStack), which can be
done at later phase.