Only allow admin to update acl

+ Add auth user library and authenticate user making request
+ Only allow update if authenticator is admin
small fix to acl
Update acl.js

Small fixes
indentation fix
don't expose err
small fixes
Merge pull request #70 from emoore24/master

Only allow admin to update acl