added DENY_ALL as default to end of acl

ordr2/resources/account.py

@@ -1,5 +1,6 @@
 ''' Resources for account registraion and settings '''
 
+
 from pyramid.security import Allow, Authenticated, Everyone, Deny, DENY_ALL
 
 from ordr2.resources.base import BaseResource
@@ -31,5 +32,5 @@ class AccountResource(BaseResource):
             (Deny, Authenticated, 'register'),
             (Allow, Everyone, 'register'),
             (Allow, Authenticated, 'settings'),
+            DENY_ALL
         ]
-

ordr2/resources/base.py

@@ -44,7 +44,7 @@ class BaseResource(object):
 
     def __acl__(self):
         ''' access controll list for the resource '''
-        return [DENY_ALL]
+        raise NotImplementedError
 
     def __getitem__(self, key):
         ''' provides the dict like interface to access child resources