loopback acl to User's property

I want to add a property called profile to User model:

  var User = app.models.User;
    User.profile = function(cb) {
      cb(null, "TEST");
    }

  User.remoteMethod('profile', {
        accepts: [
        {arg: 'id', type: 'number', required: true}
          ],
        returns: {arg: 'id', type: 'string'},
        http: {path: '/:id/profile', verb: 'get'}
  });

Then I added this ACL:

  var ACL = app.models.ACL;
  ACL.create({
    model: 'user',
    accessType: 'EXECUTE',
    principalType: 'ROLE',
    principalId: '$owner',
    permission: 'ALLOW',
    property: 'profile'
  }, function (err, acl) {
    console.log('ACL entry created: %j', acl);
  });

When I go to this url : http://localhost:3000/api/users/2/profile, it returns Error: Custom message: Authorization Required. The access_token is correct because when i go to http://localhost:3000/api/users/2/ it returns me correct data. What do i miss?

via Le Duy Khanh