[squid-users] Problem understanding acl

I want to have the following scenario but I can't understand how to do it

# Employee general access to a list of sites
acl allowed-sites dstdomain .thisdomain.com .thatdomain.com
http_access allow allowed-sites

# Some employees listed get access to all EXCEPT the banned sites
acl banned_sites dstdomain .abc.com .msn.com .hotmail.com .go.com
.playboy.com
acl password_access proxy_auth someone someone-else anotheruser
http_access allow password_access but deny the banned_lists

# And finally deny all other access to this proxy
http_access allow localhost
http_access deny all

How can I limit the password users to all but the banned sites?

-- 
Chris Mason
NetConcepts
(264) 497-5670 Fax: (264) 497-8463
Int:  (305) 704-7249 Fax: (815)301-9759 UK 44.207.183.0271
Cell: 264-235-5670
Yahoo IM: netconcepts_anguilla@yahoo.com 
-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.