Only allow admin to update acl

+ Add auth user library and authenticate user making request
+ Only allow update if authenticator is admin