s4-ntvfs: added allow_override check based on use of NT ACL