acl sanity checks

Another queued thoughts.

the following access list is 'insane':

acl foo src X
acl bar src Y

http_access allow foo bar

because it can -never- match.
likewise
http_access allow foo !foo

whereas
http_access allow !foo !bar
is sane because it can match.

We should check for insane conditions. Such conditions include:
multiple differing positive ip acls of the same type on one access line.
Ditto for domains.

Rob