Re-checked this a bunch of times because the release notes specifically mention fixing this:
http:requestAccess()now returns false instead of true if access was previously denied
But the behaviour is still like before; The first time (when the permission dialog is shown) the return value actually reflects whether or not permission was granted, but on the next launch it just always returns true, even if access was denied.
Verified this on sim and device, and for both http.requestAccess() and tcp.requestAccess()