finally! I won ACL in node.js
user emails encoded