authserver gets ACLs by session cookie (fe_typo_user)