Amend capability resolution to not double-call on write revoke

Also, change it so we free depending on the error code, giving us an
easier way to handle return errors that doesn't deadlock.

Signed-off-by: Adam C. Emerson <aemerson@linuxbox.com>