Implement proper ACL checks and suid permission

Placeholder, not finished yet.

Tests needed still:

Anonymous (api/1.0):
- simple denial case
- if we reference two containers, 1 has setuid, 1 does not (api container has, other doesn't, and vice versa) <--- should be denied
- if setuid and read, should be allowed
- setuid on api container, and setuid and no acl on another container, check if we can write to other container (that is, create objects there)
- if job has read permissions and no setuid, anonymous should not work in this case (authorized users would be allowed, though-- because other user will be billed instead of the owner-- and we can't bill anonymous users, sadly =P )