Apply ACL restriction filters for a search query

I think we should strictly keep ACL stuff and querying segregated. Giving a list of databoxes/collections to consider seems to me a premature optimization. And this method will be more easily cacheable without that.