improvements to group auth

url variable substitution
multiple acl and auth combinations allowed