Fixed #3454.

As stated in the my comment in #3454, access to a resource is denied with a global deny policy and a permission on a parent.

This PR just adds a test to show the behaviour. I might be able to write a fix, but I'm not yet sure of that. The ACL code is quite complex :smile: