Fixes: #2670 ACL refactoring

ACL are now always based on roles.
Old ACLs will needs to be migrated.