Allow services without RBAC rules to use CAS

Services without RBAC rules in the service registry should fallback to
the original behavior - give all authenticated users access.