Support authorisation when reading from $all

Currently, reads and subscriptions to $all require admin access, which isn't good for security.

Supporting auth for $all will have performance impact when ACLs are used, but in combination with policies it could be fast enoguh because policies, unless misused, should be small enought o keep them all in memory.

When admin reads and subscribes to $all, keep it as a shortcut without auth.