fix(webservice): Do not give object count unless ACLs allow it

Now if a user calls count on the webservice it will get the number of
 objects it’s allowed to see.

issue #5704