Add ACL table. Update REST specs.