Add support for magic "admin" ACL that is only satisfied by appengine administrators.