set ACL on installation object only if we are sure we logged in