Add authorization check in the update ACL bits of the API