Moving the debug log at the proper place.

If we don't do this, we might get the following in the logs:

  2014-04-08 20:00:59,354 - DEBUG: Section 'r' matches
  2014-04-08 20:00:59,354 - DEBUG: Section 'r' does not match

which is a bit confusing.
Fixing anonymous user being able to RW with any ACL setting.

If we don't have this, the anonymous user will be checked in
_read_from_sections against one of the following regex:
    "owner_write": "[r]\nuser:.*\ncollection:.*\npermission:r\n"
or:
    "owner_only": "[rw]\nuser:.*\ncollection:^%(login)s/.+$\npermission:rw",

via:
    user_match = re.match(re_user, user)

Now since an anonymous user means user == None in authorized(user,
collection, right), and user == "" in _read_from_sections(user,
collection, permission), re.match(".*", "") will always return True,
giving at least the read permission for anonymous users.

Here we bypass the _read_from_sections process, as it was intented by:

  return (
      rights_type == "none" or
  ...

If rights_type is not none, then there is no reason for us to check
permissions for an unauthenticated user.
Renaming the regex.py methods args for coherence.
Adding a new "authenticated" ACL type.

When set, all authenticated users will have rw permissions on all
collections, but no anonymous user will be able to read or write any
collection.