don't we want here the same behavior as in the 2 cases below ? i.e. `if authorizer.hasPermission()` `return acm.hasPermission(path, actions)`, in other words take ACLs into account always.