Fix signficant bug in AccessControl. Deny was not working with criteria