Use User objects directly in ACL checks.
Fix tests for modified ACL.
Add tests for extended ACL.

Fix handling of case where auth service isn't set.
Merge branch 'acl-fix' into develop