I ended up temporarily fixing it by resending the javascript ajax call to post to the page, but with no ACL rules. I saved another ACL list on another switch the same model and copied its post payload.
So its obviously something wrong in the error checking code for SwOS. Anyone have any ideas?