move acl requests into the server as resource

we should have a different controller for mirrorbrain admins.