added check_acl option
improved protected route checking