docs: function isAuthorized(acl, user) {
      acl = u.str(acl).toUpperCase();
      user = u.str(user).toUpperCase();
      if (user && user === acl) return true;
      if (!aclRe[acl]) {
        aclRe[acl] = reAccess(sessionOpts.acl[acl] || process.env['ACL_' + acl]);
      }
      return aclRe[acl].test(user) || aclRe.ADMIN.test(user);
    }