Using AccessResult and corrected checkAccess doc

In response to core issue 2287071
deny apparently was "ignore", this should return AccessResult::create()