Non-blocking but useful improvements to Account ACLs

* Additional Account ACL functional tests
* Refactorings suggested in Account ACL review
* Verify in core Swift that Account ACL data is JSON, to guard against
  bad-neighbor auth middleware

Change-Id: Ia012be0473f9ecda33c74183ea88ee324bb1febe