Add recursive support for ACL module (fix #5053, fix #5550, fix #7276)