Make ResourceAccessSecurity provider context and application context behave the same way

The problem was described and discussed in [1].

GateResult.DONTCARE should be renamed to GateResult.CANTDECIDE to better reflect the intention of the returned value.

Application context should behave like provider context and do not grant access if registered ResourceAccessGates only return GateResult.CANTDECIDE.

This behavour should also be covered by some more integration tests.

[1] http://markmail.org/message/dhvi5qa6573xhff6