Fleshes out Acl checks in NotesController.