simple acl
sqlstore and user