Fix #324: Move ACL back-end manipulations from bucket / key to acl objects

See #324.
I'm in favor of a re-word of this comment. It's not weird, it's Pythonic.