Do not iterate on all principals in IsAllowed() if not necessary

[leplatrem]

When a request comes in, skip principals that are irrelevant.

For example, remove groups if policies principals do not mention any group:. (Also applies to tags, userid, etc.)