enforce ACL check in backup.php

Ticket #4458.
Merge remote-tracking branch 'origin/4458-backup-no-acl'