Implement Simple access manager

This should be replaced by a facet-aware access manager which allows access on documents based on facet rights.
However a simple demo-capable implementation could be to allow systemuser to have all rights, but have deny (read) rights on nodes having a special property/mixin type.