Reorganize ACL save logic. Add some negative tests for ACL