support for 'remove' ACLs + test