Improve the ACL matching algorithm

See https://github.com/strongloop/loopback-example-access-control/issues/8