Private acl object support

Resolves #146 
But then this check and underlying SQL query would get run every time the hooks are executed. For example, loading the media library with 1000 images, `wp_get_attachment_url` will be called 1000 times. Why not once and add the filters if necessary?