added acl middleware and locked check