We now return empty ACLs when a user requests an asset from a project they don't have access to