More notes on bucket metadata (esp. ACLs)