Fix handling of ACLs with multiple groups

Fixes #1854