really treat the right side of acl.{allow,deny} as a list of users...
really treat the right side of acl.{allow,deny} as a list of users
the current implementation seems to expect only user per pattern, which
contradicts the documentation available at the file beginning.
