Add ACLs - only admin user should be able to enumerate other users, groups and roles

[denismo]

[denismo]

At the moment any logged in user can see other users, see their groups and keys. Even worse, they can MODIFY those, for example, can add themselves to all groups thus gaining permissions.