Fix #324: Move ACL back-end manipulations from bucket / key to acl objects

See #324.
Does this differ from `self.add_entity`?