Fix a bug in merging ACLs