Validate access control

[tannewt]

We should check accesses against the access control list. Right now we let everything work.

[Apollon77]

This is also mainly a topic for completeness :-) Sure, important for the security. The reality as of now is that each controller is Admin and basically gives out admin rights to itself and hubs. Will be relevant for bindings later