helpers: Improve ACL asserts

Modify `_it.shouldBeAllowed` to include the actual status code
in the assertion error.

Modify `_it.shouldBeDenied` to assert the exact value of the status
code. Expect the status code configured via `app.get('aclErrorStatus')`,
add a parameter allowing callers to override this value.

This is a follow-up for #12.

/to @ritch please review
/cc @karlmikko