implements AccessRule::module and fixes #4999

If `modules` is specified it is logical not to match "no module" i.e. `$module instanceof Application` doesn't look correct.