Return 405 on object ACl HEAD requests

Fixes #528

HEAD requests for an object ACL are not supported. This change removes
HEAD from the list of allowed methods for the object acl reource.
Merge branch 'bugfix/object-acl-head-500' into release/1.3