Enable access control

Existing models are not affected, i.e. they still allow anonymous access. We can't enable access control for them until loopback-explorer supports authorization (see strongloop/loopback-explorer#7).

/to @raymondfeng please review, feel free to merge.
/cc: @gmxtian @sphess