Rewrite Access Controller

* Simplify AccessControl's interface.
    * Reduce isAllowed's parameters 5 to 3.
    * Add Add isCreatable() instead of Operation.CREATE
    * Reanme Operation.EDIT to Opeartion.UPDATE
* Remove unnecessary Permission entity.
* Add SiteAdmin entity to classify who is Site Admin.