If the user specifies an `allow` and then a `deny`, will puppet reorg the list so that the `deny`'s appear first to conform to http://msdn.microsoft.com/en-us/library/windows/desktop/aa379298(v=vs.85).aspx? Or is it assumed the user knows what they are doing, and puppet just applies them in the order listed?