s4-acl: Added a flag to mark an element as failing an access check.