Limit REST requests to an ACL

Resolves #28