I would have thought there would be an else here, setting user_acl_rest = rest ... since it's supported in nginx in 11+