Lua was the only remaining user of ACL instead of (login/)password.
This is now fixed, so there is no need to clutter the httpd core.