Added a layer of ACL to collections. If Collection permissions are defined, check ACL based on those first.