Webauth token.acl fixing