The ls method of the webservice was bypassing ACLs and returning too
 much data.
The count method is still bypassing ACL but I can’t decide if this
 should be fixed or not (and how)

issue #5704