Update: add access control mgt support for jcr2spi

as per our discussion: the client should not make any assumptions about how ACL is working, so it can't cleanup privileges for the user. this has to happen on server side. we also do not re-sync automatically, but the user should probably do that if he intends to further use the policy information.