allow `@:callable` on abstracts (closes #3218)
move ACL handling of generics to right place (closes #3155)