Update "acl ch" docs to explicitly state that service accounts are considered to be users.