Wire Access control into Contexts
This commit adds acl handling in the contexts of new API.
We cache acl privileges from a check in location to prevent too many checks for the same location.
I changed the naming here and semantics to keep the access determination in one place rather then splitted in several places, so the required privilege is directly handed over.
Additionally, the cluster gets injected into the location.
