acl-plugin: missing "deny" parameter in API