acl_users is one of the rare objects (with SQL connectors) which are
intended to be fetched by acquisition, allowing overrides.
Also, move code out of try..finally block where possible.