adds acl and removes composer.lock