denying access except for specific domains and paths

Here's another option:

when HTTP_REQUEST {
    switch [string tolower [HTTP::host]] {
        "img.domain.com" {
            switch -glob [string tolower [HTTP::uri]] {
                "/path2/*" -
                "/path3/*" {
                    return
                }
                default {
                    HTTP::respond 403
                }
            }
        } 
        default {
            if { not ( [string tolower [HTTP::uri]] starts_with "/path1/" ) } {
                HTTP::respond 403
            } else {
                return
            }
        }
    }
}