Class based ACLs and ACL checks in UserController