more work on ACL stuff: tighter integration with Zend_Acl, hasCredential() now performs checks against the ACL (pass administrator and it'll check the role, pass product.edit and it'll check the operation on that resource). All still a work in progress and subject to change. Refs #1394