Fix #324: Move ACL back-end manipulations from bucket / key to acl objects

See #324.