Access Control: fix transaction (#472).

Starting without DB throws no NotInTransactionException.

Access Control API:
These methods create a transaction:
    - setCreator()
    - setOwner()
    - setACL()

Thanks, Malte, for reporting!

See #472.
Merge branch 'master' into drop-ext-http