user management and acl bugfix