Refactor ACL, added support for session user set/refresh