Allow for more flexible access rules declarations

Makes sure every rule passes (not just some), picks the result of the
first failing rule (we are mostly interested  in the "Location" header)