clean up acl

Incremental towards #882.