improve speed for aclpolicy checks for #328