resolves issue where user with 'writer' role can't list ACL

Fix for https://www.pivotaltracker.com/story/show/68547530 (Unable to list ACL if user includes "writer" role)

Added integration test, gave writer who also has read privs the ability to read the ACLs, and changed an underlying class in the test framework to allow tests using users with multiple roles.