Better tests for ACL support.

test_405 is broken, however. Getting 403 for POST /service
Fix test_405.