Tests and proposed fix for WFLY-1985

Hi Brian,

it's fairly embarrassing that none of my tests revealed WFLY-1985 which was found few days ago by Jakub. I just tested that read-attribute returns correct response (permitted, denied, can't address) and didn't inspect the response further... so it contained the correct value all the time, even when it shouldn't. I added tests for that in the first commit -- they are correctly failing.

The second commit contains a proposed fix. It works, it's fairly simple and it's totally not satisfying for me. I do have a mental problem with the fact that the authorization is done _after_ the read-attribute operation is actually performed -- but I guess that it's needed because of vault expressions? If there is no need to do the auth after the operation, I'd prefer if the order was swapped.

Thanks!

LT