Fix #139: clear existing (local) ACL when saving defaultObjectACL to server

See #139