So if an empty default ACL isn't invalid, do we even need the ``if defacl.valid():`` check on line 222 below?