handle private classes correctly when dealing with ACL (closes #2555)