Fixed an issue where reading `acl.json` for wildcard (*) ability was not being checked for both array and string in authorize method.