JCR-2950: make the special case for root ID handle cases where there's no ACL on the root node as well