ACL checks changed

- until now checkAction was used to check permissions of a user

- but since all of the role permissions are checked beforefilter in
appcontroller and saved into a public array, doing a lookup of the
array saves an SQL call for each permission check.