Fix anonymous access authorization

Only enable it if requested for some storage area
Enforce longest path match iteration

Two aliases starting with the same prefix (/test,/test1) could confuse
storm-webdav path resolution mechanism.