Support wildcard for user and roles

Need to be able to wild card both users and roles in the allow/deny; this is so we can override a specific permission without the fallback taking precedence, e.g.

```
    <activity name="Person.Create">
        <deny roles="*" />
    </activity>
```
