updating kv.sql to support all acls

right now this code probably doesn't work but it has the conceptual
basis down.  more testing will clean it up, but I can't be bothered
to debug it right now.