better acl decorator structure (avoid double validation)