Added check for ACL resource before calling isAllowed()