added acre.private API for models that should only be accessible via an admin