oh, sorry for missing that.

FYI, I would be expect this code to be in the *ACL class and have the bucket call it, here it's the other way around.