Trac's authz_policy with some improvements.