Implement proper ACL checks and suid permission

Placeholder, not finished yet.
Shouldn't there be a `acl=` argument here? Perhaps: `self.authorize_job(req, acl='read_acl', remove_auth=False)`?