Introduce ``list`` permission, bind ``listing`` and ``contents`` tile to it and adopt default ACLs.