feature: authenticate plugin
fix: ACL plugin now handles document(s) on input and output