'group' and 'user' field should be wildcard-able in the aclpolicy files

[diranged]

The group/user fields should be wildcard-able in the acl policy files so that I can say:

by:
group: '.*'

Additionally, the documentation should be updated. Right now its unclear that you cannot do this, and the code does not throw any errors or warnings about it either.