[1.2.4] [FIX] ACL allows access to forbidden resources

See #1303