Thanks for the patch, Daniel Sturman!
I think your read of the code is correct; the storing/updating thing was backwards.
The check around the debug line in logRootNodeAcls() is superfluous because the check is always done before calling the method. In general we only do the check before doing something expensive, so the one at the end of loadApplicationAttemptState(), for example, is also unnecessary.
While you're at it, I'd pull the preceding log line into the if since it's the same info as the one in the else. That way we don't get (more or less) the same message twice when creating a new entry.