A number of patches to prepare for stricter mail ACLs

@mh wdyt?

See individual commits for details.

Not everything is tested yet, so don't merge without checking if it works...