Update: make access control config a function of the request

This enables APIs to moderate access rights based on request data and
not just the statically parsed components of the URL.