changed logic for assertion part

old logic:
1. if identity hasn't roles - no checks for assertions. (why?). return false (no granted)
2. if identity roles don't have a permission - no checks for assertions. (why? WHY?) return false (no granted)
3. checks assertion - no comments, it's ok
4. return true, hmm... ok

new logic:
1. if identity has one or more roles and any role has permission - return true
2. if has assertion - check
3. return false - (no roles with permission and no assertions)