Quick fix for #765 - ACL checks in the media manager ajax calls

This should be superseded by a proper rewrite of the media manager code
hotfix release for #765