hal version 0.5.9-0.git20070218.fc7 introduces the ACL-setting feature. However,
this version doesn't recommend upgrading gdm to a recent-enough version which
has proper ConsoleKit support.
I spent quite some time banging my head against the wall with this, until I ran
ck-list-sessions and realized CK knows nothing about my session. Then I've
yum-upgraded gdm and the problem was solved.
Interesting. But as things work now I'm closing the bug.