added ACL for module. ACL for controller should be done in controller init