Let block_acl() work as advertised. If the last matching acl directive denies access...