According to the docs all `deny` attributes override `allow` attributes.  That seems wrong and would make the above impossible.  @jimis can you confirm?