fixed explanations about how access control rules work
Furthering @fabpot's changes to the access_control explanations in the security chapter