Move acl info to the extra dict on Object.
Split up the object hierarchy a bit as recommended by @Kami.
Test for token support.