Updated ACL for user model