minor refactoring in checkacl