[WFLY-490] Adding a sanity check to verify that the configuration is not resulting in the user locking out all access when RBAC is enabled.

Allow for identity executing current request to be switched, in this case an operation switches to an IN-VM call as it can not be assumed the remote user has access to all aspects of the configuration being validated.
[WFLY-490] Check of an empty list as currently getting an empty <include/> or <exclude/> element written out if the last value is removed.