Fixing acl canread2

There were a number of issues in the ACL, which prevented object canRead from working correctly