extract ACL refs handling to access-controls