Support wildcard for user and roles

[phatcher]

Need to be able to wild card both users and roles in the allow/deny; this is so we can override a specific permission without the fallback taking precedence, e.g.

    <activity name="Person.Create">
        <deny roles="*" />
    </activity>