support comma-separated type paths in @:allow and @:access (closes #3390)