using access rules in HTTP handler