Fix a couple of bugs in ACL substitution mechanism

- %GROUP% & %USER% can now both be used in the same rule, e.g.

%GROUP%:%USER%    2

- rules with tokens will be skipped when the user is not logged in
  previously %USER% was attempted