Make HTTP auth really override acl, it does it anyway