a proxy ACL now does the mockito dirty work