rule302: better filters rule401: Only report ACE if IDENTIFIER=* and access allow DELETE or WRITE rule403: fix a bug
