MT#4565 Fix read-only permissions.

Properly deny write ops for read-only admins and resellers.