Fix save/clear ACL operations.

Borked by dropping the 'projection' qs param to PATCH.  Docs spell
a default, but then note that overriding it w/ 'full' is required
(and we need 'full' anyway, because we expect to read the resulting
ACL back).
Accomodate 'stick' ACL entries when clearing bucket's ACL.

Back-end preserves some of them even after a successful PATCH with
data .