add location_allow/deny directives