Add ACL checks to adminhtml controllers