Add ACLs

work in progress:

- [x] basic ACLs checks based on roles
- [x] modify http middleware to cary user user's roles
- [ ] extract ACL code as a library

Despite the last point. Ready for merge :)