improve acl hook to support multipul roles