Added AccessRestrictionExpressionRoot, with permitAll() and denyAll() for URL access restriction evaluation.