[auth] fix horribly insecure ACL bug