Bugfix/vov 1819

Two (pending) tests would still fail if we let them, and there's still a bug in the code. But it's been fixed and pulled into hydra-access-controls, so the next release will fix it with no additional action from us.