We need to check for a matching acl only if one match hasn't already been found, otherwise results are unpredictable and order dependent.
Fixes: https://fedorahosted.org/freeipa/ticket/2343