Fix #324: Move ACL back-end manipulations from bucket / key to acl objects

See #324.
I think `_URL_PATH_ELEM` is probably better (it is used for generating the *request* URI).