diff --git a/lib/server/setupStore.js b/lib/server/setupStore.js
index fd26378054..73bf9629f9 100644
--- a/lib/server/setupStore.js
+++ b/lib/server/setupStore.js
@@ -7,6 +7,7 @@ module.exports.queries = function(store) {
 };
 
 module.exports.accessControl = function(store) {
+  store.accessControl = true;
   store.readPathAccess('users.*', function() {
     var captures, next;
     if (!(this.session && this.session.userId)) {
diff --git a/src/server/setupStore.coffee b/src/server/setupStore.coffee
index e95c694490..c4a790227e 100644
--- a/src/server/setupStore.coffee
+++ b/src/server/setupStore.coffee
@@ -3,7 +3,7 @@ module.exports.queries = (store) ->
     @byId(id)
     
 module.exports.accessControl = (store) ->
-  # store.accessControl = true
+  store.accessControl = true
   
   # FIXME callback signatures here have variable length, eg `callback(captures..., next)` 
   # Is using arguments[n] the correct way to handle this?