Access control refactoring: Added dedicated FileItem interface because not all items are configurable anymore. Added ManagedUserReference because otherwise the TransientUserReference would violate Liskov's substitution principle.
Changed paths: