It's checking ACLs via API but not sure about this, I'll have to dig into it a bit.