Improve the ACL matching algorithm

/to @ritch 

See https://github.com/strongloop/loopback-example-access-control/issues/8