MAGETWO-56796: Any admin user can upload Favicon Icon

 - made ACL resource more restrictive

Author: Cari Spruiell

app/code/Magento/Theme/Controller/Adminhtml/Design/Config/FileUploader/Save.php

@@ -22,6 +22,11 @@ class Save extends Action
      */
     protected $fileProcessor;
 
+    /**
+     * Authorization level
+     */
+    const ADMIN_RESOURCE = 'Magento_Theme::theme';
+
     /**
      * @param Context $context
      * @param FileProcessor $fileProcessor