Private acl object support

Resolves #146 
There is two filters there - `$default_acl` gets passed into the first (deprecated) returned as `$acl` which is passed into the second filter. 

Perhaps `$default_acl` should be named `$acl` for clarity?