Refs #37 - Define security.access_rules so it can be extended.

Add useful comments.