Core: Added default ACLs

Since we're exposing more stuff via XML-RPC, this adds a default,
fairly restrictive ACL plugin if no other ClientACLs plugin is loaded.
This makes us secure by default.