ACL.impersonate uses pre-java 7 patterns and either ends up with requiring a finally or requiring additional classloading.

Much more efficient if we can do something like

try (ACLContext _ = ACL.as(auth)) {
  // do some stuff as auth
}