Security fix: Access control list and privilege. closes #97