fix url helper call into template as well as wrong check to ACL