Debugging named ACLs is hard

See #3481 & #3482 for context.

There is much room for improvement in terms of making named more verbose about which ACLs matched during query processing and which ones did not. Better logging would help administrators understand and fine-tune ACLs.