When a custom rule sets ACL_MANAGE to 0 to disable ACL management for a particular device, handle this as "disabled", by explicitly checking against "1" instead of "nonempty". Thanks to Rafał Rzepecki for pointing this out.