ACL calls get username from token, not from session