.by_acl returns user's group + public group