from an ACL list if it had no permissions remaining, which confused
aclcheck terribly.  Also clean up code a little.