There is a bug here or maybe i'm using the gem wrong...
you should merge the ACLs after merging the meta_has if not The new permission will be overwritten by the old one. 
If Before you had a directory with : 
X-Container-Read: .r:*,.rlistings

and you make your directory private again. The new read_acl will be overwritten by the old one in the mata_hash