Add documentation for accessControlMiddleware methods
Disable queryParser() middleware
 - no need to use query string
 - it's better if confidential params are allways send via post rather than url query string