Fixed bug where an allow on a parent URL was taking precidence over the
disallow on a child URL. The more specific (biggest matching) rule takes
precidence.