Adding support for ACL system

Fixes #201. This adds support for a capability-based ACL system. Tokens can be provided as part of requests, and have policies to restrict access ala AWS IAM.