Windows cf-serverd grants access to root. Redmine 4822.

Technically, if the file is owned by the given user but isn't accessible by that user (e.g. ----rwx---), we should decline access.  Probably not worth caring about, though, unless there's a simple "can that user access this file" test function ...