I really should not commit my console logs...
fixed ACL checks on update