Quick fix for #765 - ACL checks in the media manager ajax calls

This should be superseded by a proper rewrite of the media manager code. I tried to touch as little code as possible, my main goal was to provide a clean environment for the ``media_tab_*``-functions and the ``media_diff`` function and not to rely too much on the globals and possibly wrong URL parameters.