from an ACL list if it had no permissions remaining, which confused aclcheck terribly. Also clean up code a little.
