Add missing return in ACL

This has no externally visible impact because the rest of the code
behaved correctly, but would reduce the number of allocations.