added more tests, when you use a canned ACL, amazon implicitly sets a grant of FullControl for the owner,
but if you try to create an ACL from scratch, the owner's implicit FullControl is not set