added :access-rules key to app-handler

added an easier way to specify access rules