helpers: Improve ACL asserts

Modify `_it.shouldBeAllowed` to include the actual status code
in the assertion error.

Modify `_it.shouldBeDenied` to assert the exact value of the status
code. Expect the status code configured via `app.get('aclErrorStatus')`,
add a parameter allowing callers to override this value.

Allow tests to send arbitrary request body in the requests being tested. This is needed for loopback tests of `User.create` to pass valid User data in order to prevent 422 validation error.

This is a follow-up for #12.

/to @ritch please review
/cc @karlmikko