ACLs: restrict by IP and user