Preliminary tweaks to expose object ACLs and groups via the REST API.