Add allow_acl helper function
Rework callback resolver for authentication, tidy up settings.