Improved ACL (including if both ns=user)