Fixes #5118

Also fixes robot/access() so that it will accept any one of the accesses
in req_access, instead of all - a much more likely use case.