use "expand" instead of "regex" for group ACLs that allow substring expansion,...

use "expand" instead of "regex" for group ACLs that allow substring expansion, preserving backwards compatibility; add sanity checks