continued refactoring of CAS auth and acl

almost done. Using a controller action helper to run acl.