do not treat empty array as permission denied

The problem: on complex permissions, if "read" filters out the collection to an empty array, we get permission denied. This makes it hard to distinguish between empty data sets and real permission denied situations.

P.S. IMHO, this shouldn't break simple permissions, as permissibles variable is supposed to contain the outcome of permission check, unless I missed smth