cgi-io: use different acl scopes for path and command permissions