ACL and current user now manipulated only in views