Changed User::require_auth() to User::require_acl() to be clearer
Added Controller::require_acl() that accepts a list of resources for one-line fine-grain access control in handlers
Switch user type check to acl
Added acl check to tools menu
Added user roles list page, no add/edit/delete yet
Improved editor role
Renamed user type -> user role
Started adding acl-based permission checking