Add acl_from_headers

Make either a canned acl, or an acl from specific header grants