DefaultAclManager does not handle multiple restrictions correctly.

The converter does combine all restrictions it finds into one repo-init restriction() statement.

That is not correct - it needs to add one restriction() per restriction found.