Streamline can_run access control method

Minor rework of can_run() to replace the chain of elifs with simple
short-circuiting conditions each with its own return() so that it's
clearer this operates in a "first match" model.