Use pass-by-reference semantics for setting access policies.

- Switch the default save flag on access control mutators to
  False, since that is a more common case, and more intuitive.
- Fix typo bugs in folder model. improve test for it.