Change intention to deny doesn't take effect using native client

#### Overview of the Issue

When using a native client (I'm ussing Go in this case) if I change a intention from allow to deny I keep having access to the service (ussing consul connect proxy). I have to restart the connect proxy for it to take effect.
Going from deny to allow works fine.
Using a connect proxy as client works fine too.

I'm using a HTTP connection from the Go client using the following transport

```
var svc *connect.Service
....
tr := &http.Transport{
// TODO: timeouts
DialTLS: svc.HTTPDialTLS,
}
// when a we use a native golang client we must not enable http2
// see: https://github.com/hashicorp/consul/issues/4466
// http2.ConfigureTransport(tr)
```

#### Reproduction Steps

1) consul agent -dev -config-dir=/tmp/consul
2) register a service (HTTP server)
3) launch proxy:
consul connect proxy -service -service-addr=127.0.0.1:8000 -listen ":21000" -register -log-level=DEBUG
4) use a native Go client to access the service through connect.
5) create an intention to deny access

### Consul info for both Client and Server

Consul v1.4.0