Fix ACL model

/to @ritch 

The PR contains two changes:

1. Use 'this' to access static methods that are potentially from the subclass of ACL
2. Fix the ACL.checkAccess where defaultPermission was not checked