quite a bit of work on default acl permissions and various acl quirks