In fact, I suspect that your example would reset any preceeding denies, since it matches everything and according to the web page "the last match always takes precedence."
True. True. I should have reviewed my own documentation. It's been 3 years. You may have stumbled on a bug. I have a hunch for a workaround. Try this: allow|mhamilt deny|||test_tag_branch2 (No trailing || after your userId.)
