added access control for ACs and updated users.json path