Private acl object support

Resolves #146 
The way you have it now, it runs on every page load, frontend and backend.

It would be a lot better if it only ran on page loads that called those hooks. Also, `$this->get_setting()` sets a class variable so it only runs the SQL once per request.