AUTH_ACL_CHECK event around ACL checking

As suggested in #481 

allows to modify ACL results in the AFTER event or to implement a completely different ACL mechanism in the BEFORE event.