A Logic-Based Framework for Web Access Control Policies