This moves ACL enforcement from the header files to the `client.inc.php` &
`staff.inc.php` files so that AJAX/PJAX may bypass ACL.