Access Control: fix ACL for user accounts (#375).

A User Account is editable only by a) the respective user, and b) by the creator of the User Account.

Note that a Username is supposed to be fix. But there are still glitches:
    - Changing the username when a User Account is selected throws an exception and rolls back.
    - Changing the Username topic of the current user directly throws an exception corrupts the current session.

See ticket 375.