fix bug in acl implementation