Improve/tweak the "idDenied" logic in the Acl class