add ACL authentication