Update AclHelper.php

Correction of variable name used throughout getAllowedActionsByUserId(), swapped from $roleId to $userId
Fixed a bug in updateAll as modelAlias.id could not be an array - refs #451
BlocksComponent: Accept ',' for multiple values in conditions

Eg: `[node:recent conditions="Node.type:article,news;"]`

Closes #457