bucket: skip auth if special ACL flag is set