acl-plugin: implement an optional session reclassification when ACL is (re-)applied