more tests - now testing setting ACLs by email address