AccessControl denyCallback call fix - #2036

Also I wonder if [`$denyCallback`](https://github.com/yiisoft/yii2/blob/master/framework/web/AccessRule.php#L88) in AccessRule is being used somewhere.