Implement proper ACL checks and suid permission

Placeholder, not finished yet.
Otherwise it leaves `node.path_info = None` which is not desired (more checks down the line).