acl should allow Default to do all, but omit the acl_rights_after line.