Various ACL fixes

# do not merge

/to @raymondfeng 

This is the result of our pair programming the `$owner` fix. It has some regressions in it. Can you take a look at the failures? As a reminder, the needle we were looking for was `inRole` wasn't being used to filter the `effectiveACLs`.