Verify that ACLs are enforced in DeX

[rogerdahl]

In particular, make sure that a manually created URL cannot access non-public / embargoed data. Especially check this for the path on DeX prod, where DeX accesses data directly over NFS.