SecurityService refactoring

extract acl to separate class (AclManager)
create fluent interface for granting rights.
something like: acl.grant().toUser(username).admin().read().on(object);
acl.remove().fromUser(username).admin().read().on(object);