Reverse dns access rules

There is a bug in our new ```admit_hostnames``` reverse-dns access rules.

These commits are just the start. They change very little semantically, but reshuffle and rename a bunch of stuff.

Also add a bunch of new tests, always a good thing.