[Issue 9800] ACL with set.expand in <who> clause does not work with deref control