Support session IDs in XML envelopes for inserting/updating features. Fixes #49

Also round out the ACL unit tests. Fixes #47