chef_acl resource

Per discussion, this should be conjoined with the if