Rights metadata should only update the user you tell it to update.

self.class.terminology.xpath_for was matching too greedily such that it
would find 'user12' when you searched for 'user1'. When you tried to add
permissions for 'user1' it erased already existing permissions for 'user12'