Apply ACL restriction filters for a search query

Are you sure about a `should` here? It should be a second `must` clause IMO. Since `minimum_should_match` defaults to `1` it will work the same, but that will prevent breaking if someone adds another `should` clause here.