[server] Add access control feature for getting items.

TODO: Add tests for it
[HostResourceQueryOption] Fix a bug that resources on unauthorized servers can be fetched when a target server id is specified