Fix a couple of bugs in ACL substitution mechanism

- %GROUP% & %USER% can now both be used in the same rule, e.g.

%GROUP%:%USER%    2

- rules with tokens will be skipped when the user is not logged in
  previously %USER% was attempted
fix a bug in acl manager where it attempted to correct too high page permission levels using the wrong var
Merge pull request #261 from splitbrain/acl_tokensubstitution_fixes

Acl tokensubstitution fixes