authentication with ACL and album module