When setting ACLs in the API, one may specify more than one branch and acl

Fix a small variable name as well
Retrieve the acl and branch from the form as list and specify the list of collections to the form
Handle the AUTO_APPROVE ACLs in the API as well and order by branch first
Fix the unit-tests