implement acl for webserver

closes #1494