use ACL.impersonate instead of SecurityContext.setAuthentication and use private helper method for handling notifyCommit