grumble, pkg/acl: move ACL handling to the acl package.
pkg/blobstore: use correct Open signature in tests.