Update extras API to return canPublish using document_acl table

Close #253