Support negative lookups for ACLField.

A bit ugly but still better.