really treat the right side of acl.{allow,deny} as a list of users the current implementation seems to expect only user per pattern, which contradicts the documentation available at the file beginning.