Whitelist mode should return NGX_DECLINED when not found.

[tmthrgd]

Whitelist mode should return NGX_DECLINED when not found.

[tmthrgd]

Looking into |ngx_http_core_access_phase| it turns out that returning NGX_HTTP_FORBIDDEN is the right thing to do for whitelisting.

For NGX_HTTP_SATISFY_ALL each access phase handler must return NGX_DECLINED or NGX_OK.

For NGX_HTTP_SATISFY_ANY one access phase handler must return NGX_OK or all other phase handlers must return NGX_DECLINED.