updated tests and others to include both endpoint acls from internal subnets and fix a bug involving affinity groups