added ACL handling, cleaned up app a bit