check ACLs work OK from tornado client