extend range of status allowed/denied

see https://github.com/strongloop/loopback/issues/301
Nitpitck: `< 400` would be a bit easier to read IMO