CVE-2020-25722 Check all elements in acl_check_spn() not just the first one