correct the order of allow and deny