Add support for tempurl & formpost

The user is unknown if a request is authenticated using tempurl or formpost. In
this case we know that the request is authenticated for the original account,
thus we can check if an ACL for that account matches and grant access in this
case.