Replace tests on allow/deny rules

They are not 100% bullet proof but test the way different combinations of
passing allow/deny rules should work.