Use _cf() versions to allow multi-user security on ACLs