A much-improved version of the --acls option that Matt and I have been