Enable access control.

Add "Customer hasMany AccessToken" relations and other models
required by ACLs.

Add unit-tests for /api/customers.