Fixes to acl and queries for site-admin role