Fix access to private rivers and buckets

* Collaborators of private rivers and buckets were being
denied access. This was because of a bug in RiverService#hasAccess -
using List#contains to check if the querying account exists in the list
(java.util.List) of collaborators