Good idea to just prepopulate it.  I assume its safer just to add both user.name and SPARK_USER to acl list if they are set?