Apply ACL restriction filters for a search query

Maybe we can avoid calling `normalizeFlagKey()` each time and keep flag keys for each databox around.