Replace default access rule covering all domains with a configurable option and some defaults

New API in mobile-config.js: App.accessRules