allow acl updates in object descriptor
provide payload generation for the "InvalidArgument" error
parse canned acls