move access control to core
fix container singleton with di bug