added flag for acl check in middleware, changed client console.log