Change access control API so that rules are now expected to be async.

This was a HUGE oversight on my part. Non-async access rules will
now trigger warnings. Boolean constants are still allowed, of course.