check ACLs correctly if only groups but no user is given FS#1415

When only an array of groups but no username where passed to auth_aclcheck()
it defaulted to use the @ALL group only. This is not critical because this
does not happen anywhere in the code.

Only exception is when building the plain english explanation of an ACL rule
in the ACL manager.

darcs-hash:20080608101051-7ad00-0abd42f84c04473ad4fca149893a1b4d931ece48.gz