acl: Simple ACL framework
query service: policy checks for URLs

Also added a falllback policy that denies
all access if the requested policy could not
be found.
Merge branch 'master' into vtocc