fix has_acl method, wrong check in credential/roles instead of credential/permission