Developers are confused by filter:null since we used to use that for oids/acls. Instead we can indicate that the ACL header has been forwarded.