Hi Dan--
You need some extra quotes there. The Acl.eval option expects a string argument, which it passes to the ACL interpreter. Try this:
var user = Acl.eval("option('user')")
Or, you just could use the standard Application.getOption(), like this:
var user = Application.getOption("user");
--Clay