SearchApiController should initialize the current AccessContext explicitly

[kjac]

As-is, the SearchApiController blindly accepts an AccessContext from the inbound request. This is an obvious security concern, which needs patching up.

The controller should resolve the current Management API user on its own and create an access context from that.

[kjac]

Origin for tracking: #125 (comment)

[kjac]

Fixed by #129