[FIX] portal_sale: remove un-necessary access rights, improve rules

Portal access rights need to be associated with
security rules, or not granted at all, as soon
as they grant access to non-trivial data.