Update: add access control mgt support for jcr2spi

lets not do this. having `<jcr:read/>` is the right thing.