Added additional acl check for 'user' resource to user chooser