Use "system" message for $acl_verify_message if there is no "user"