anchor.diff:      logon_roles(UserId, Roles, Context, ContextAdmin) ->
           RolesFiltered = [ R || R <- Roles, 
                                   m_rsc:is_a(R, acl_role, ContextAdmin),
  -                                m_rsc:p(R, is_published, ContextAdmin) ],
  +                                m_rsc:p_no_acl(R, is_published, ContextAdmin) ],
           % Merge all role's categories and modules
  -        ACLs = [ m_rsc:p(R, acl, ContextAdmin) || R <- RolesFiltered ],
  +        ACLs = [ m_rsc:p_no_acl(R, acl, ContextAdmin) || R <- RolesFiltered ],
           {Cats, Mods, ViewAll, OnlyOwn, FileSize, FileMime, VisibleFor} 
                   = combine(ACLs, [], [], false, undefined, 0, [], 3),
           Context#context{user_id=UserId,
  
positive.code: observe({acl_is_allowed, insert, Cat}, Context) when is_atom(Cat) -> 
      can_insert(Cat, Context);
  observe({acl_is_allowed, update, Id}, Context) when is_integer(Id) ->
  	case m_rsc:p(Id, is_authoritative, Context) of
  		true -> can_edit(Id, Context);
  		_ -> undefined
  	end;
  
negative.code: can_edit(_Id, #context{acl=undefined}) ->
      undefined;
  can_edit(Id, #context{user_id=UserId, acl=#acl_user{only_update_own=true}} = Context) when UserId /= undefined ->
      case m_rsc:p_no_acl(Id, creator_id, Context) of
          UserId -> true;
          _ -> undefined
      end;
  can_edit(Id, #context{acl=Acl} = Context) ->
      IsA = m_rsc:p_no_acl(Id, is_a, Context),
      can_edit1(IsA, Acl#acl_user.categories).
  
      can_edit1([], _Allowed) -> undefined;
  